It should work as you say.
Can you check what address is being used when you don's specify source argument?
One way to check is to run ping to 8.8.8.8 in one console window and in another run
show security flow session destination-prefix 8.8.8.8/32
Regards, Wojtek
