Minow, Check what Hulk said, and double check your routes (including any PBF rules). It could be that the return packet is being routed to a different interface than the SYN packet came in on, which will give you the zonechange drop counter. Craig Stancill | Technical Support Engineer Shift Time : 05:00 – 14:00 GMT Support Contact: US: (866) 898-9087, Outside the US: +1-408-738-7799 Palo Alto Networks | 3300 Olcott Street | Santa Clara, CA 95054-3005, USA https://support.paloaltonetworks.com/
... View more