When implementing a new self-signed root certificate authority (CA) for SSL decryption on a Palo Alto Networks firewall, the subordinate CA certificate (which is generated by the firewall) must be imported into the trust stores of all client devices. This ensures that client devices trust the firewall as a valid certificate authority, enabling the firewall to decrypt and re-encrypt SSL traffic.
Importing the subordinate CA certificate into the client devices' trust stores is necessary for those devices to trust the new self-signed root CA and properly handle SSL decryption traffic.

Layer 3 and Layer 2 are valid, configurable zone types in PAN-OS and are standard zone constructs used to define traffic segmentation and policy enforcement boundaries on the firewall.

NGFWs and UTM platforms combine multiple security functions into a single device, reducing complexity and improving manageability.

Segments in Cloud Identity Engine allow administrators to create filtered, logical partitions of identity data and redistribute only the relevant users and groups to specific firewalls, ensuring strict separation of employee and partner identities in compliance-driven environments.

When integrating Kubernetes with Palo Alto Networks NGFWs, the CN-Series firewalls are specifically designed to secure traffic between microservices in containerized environments.
These firewalls provide advanced security features like Application Identification (App-ID), URL filtering, and Threat Prevention to secure communication between containers and microservices within a Kubernetes environment.