You have created your tunnel interface in the untrust zone. Traffic from the trust zone is able to enter the tunnel and pass to the destination. However traffic from a different interface in the untrust zone is not able to pass traffic through the tunnel. You are using a single virtual router.
What is causing this problem?

A.
Two virtual routers need to be configured.

B.
A policy is needed since intra-zone blocking is on by default in theuntrust zone.

C.
The tunnel is configured with a proxy id that does not include the address from theuntrust interface.

D.
The routing tables are not correctly configured to allow the traffic from theuntrust source to bedelivered to the destination.