Palo Alto device is wrongly directing the traffic . DUAL ISP IPSEC VPN issue

[mhm_ameen]

we have two dynamic ISP in single VR with ECMP and we have setup dual IPSEC VPN tunnels towards single public IP to other paloalto . our issue that  PA wrongly forwarding traffic , ISP 2 is using MAC address of ISP1 when initiating VPN traffic to public ip address of second FW. 

Moreover check the source MAC address ! 

 show interface ethernet1/3 [ ISP1]

--------------------------------------------------------------------------------

Name: ethernet1/3, ID: 18

MAC address:

  Port MAC address 00:1b:17:00:01:12

Operation mode: layer3

Interface IP address: 172.20.2.250/24

 show interface ethernet1/2 [ ISP2]

MAC address:

  Port MAC address 00:1b:17:00:01:11

Operation mode: layer3

Interface IP address: 172.20.3.250/24

[BPry]

@mhm_ameen,

Are you forcing symmetric return? 

[mhm_ameen]

Yes enabled and also enable strict source path as well same even trying with 2 VR and PBF same issue we are in 10.1.6 which even we upgraded to from 10.1.5

[BPry]

@mhm_ameen,

Interesting. At least from my end, I would open a ticket so that TAC can review your actual configuration and confirm if something regarding routing is simply setup incorrectly, or if you're running into some undocumented bug. I'm guessing it's not a bug due to this being a regular setup, but maybe it's only present when select features are enabled or something like that.