$ 0 0 the Untrust interface of the Palo Alto sits behind a NATDo you have nat-t selected on the ISG side vpn?