Routing issues when using NAT over VPN

[mathiasj]

I'm looking at this document. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClipCAC
It says our selected NAT addresses (2.2.2.0/24 on PA-2020 in this case) need to be routed to a tunnel interface, in order for policy lookup to work. 

Let's imagine I'm using 2.2.2.0/24 on the PA-2020 for NAT'ing traffic not only towards PA-5050, but also towards 2 other parties (connected via tunnel.2 and tunnel.3). 

Ideally I would prefer to put tunnel.1, tunnel.2 and tunnel.3 in three different zones, but I don't see this as an option, when reading this document. 

Is my only option to put all tunnel interfaces (tunnel.1, tunnel.2 and tunnel.3) for parties, that I present 2.2.2.0/24 towards, in the same zone? And then simply route 2.2.2.0/24 to tunnel.1.

Or is there a way for me to use different zones for each VPN?

[BPry]

@mathiasj,

Are you trying to use the same NAT range across all three tunnel interfaces? 

[mathiasj]

@BPry 

Yes, that's right.