I have seen situations where it was defined the destination IP as the IP on the tunnel interface, then the routing fib-lookup was saying correctly that the result was the tunnel, however, the connection ended on the tunnel interface itself (it was not encapsulating and sending traffic over the tunnel). Make sure that 132.103.21.4 is not an IP configured on the local firewall as the Tunnel Interface's IP. If you have CLI access, ping it, if the rountrip time is close to nothing, then it's likely you've configured that IP on the Tunnel interface itself. Also make sure to check out the following Article: Sample IPSec Tunnel Configuration - Palo Alto Networks Firewall to Cisco ASA
... View more