return traffic being dropped, not being sent through the vpn tunnel

[S.Dollerup]

issue:

1 server behind PA being accessed through 2 different tunnels

tunnel 1 = working

tunnel 2 = incoming traffic working, the return traffic is being grabbed by interzone-default = deny, and on the PA seen as a new session being initiated, for which there is ofc no security rule in place to allow

anyone with an idea why the return traffic on tunnel 2 isnt being matched correctly on the PA and sent back through the correct tunnel?

 

[TomYoung]

Hi @S.Dollerup ,

Does the 6-tuple key of the return traffic match the initial traffic?  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVECA0

The security-zone is the destination zone of the initial traffic.

Thanks,

Tom