Gateway side not seeing Satellite published subnet

[jjfranzen]

I've just set up a PA-850 as a satellite to my main 3050 and the connection seems good. All the subnets published by the Gateway can be seen by systems on the Satellite side. However, the subnet being published by the Satellite can't be seen on the Gateway side. According to the Satellite Info section of the GP Gateway, it does see the satellite is publishing the subnet, but I can't ping anything on the subnet, even from the PA-3050's cli. Looking at the runtime routing stats, I do see that subnet as being routed to the next hop of the IP for the IPSec tunnel that was established when the satellite connected. So, even that looks proper. I have rules to allow traffic both to and from the zone created for the satellites, and since I am getting traffic from one direction I have to assume this is some kind of simple misconfig somewhere that is keeping the gateway side from properly routing across the tunnel to the satellite. Any suggestions as to where I can look to nail this down would be appreciated since both of my VAR's PAN experts have been stumped by this...

Cheers,

J. J. Franzen

[jjfranzen]

I think I sorted this. I had to make a specific zone for the satellite tunnel and rules to pass traffic to and from that zone to the trust, and now I can see the system on the satellite site from the gateway side. Now for the last hurdle.

How do I get someone on one satellite to be able to see the systems published by another satellite through a common gateway? 

For example, on one satellite, I have a subnet of 192.168.5.0/24 being published down the tunnel.

On another, I have 10.0.5.0/24 being published. 

The gateway can see systems on both of the respective subnets. However, systems on one satellite subnet can NOT see systems on the other satellite subnet. Do I need to add some kind of routing or NAT to bridge the two? I had hoped the gateway would handle all that...