To meet the requirement of data isolation for different regional business units while minimizing administrative overhead, the best approach is to establish separate Cloud Identity Engine (CIE) tenants for each business unit. Each tenant would be integrated with the relevant identity sources (such as on-premises AD, Azure AD, and Okta) for that specific region. This ensures that the identity data for each region is kept isolated and only relevant user and group data is distributed to the respective regional firewalls.
By maintaining a strict one-to-one mapping between CIE tenants and business units, the organization ensures that each region's firewall only receives the user and group data relevant to that region, thus meeting data sovereignty requirements and minimizing administrative complexity.

Assigning an IP address to the tunnel interface allows the firewall to perform tunnel monitoring by sourcing and receiving keepalive traffic over the tunnel, and enables the use of dynamic routing protocols such as OSPF across the tunnel because the tunnel interface becomes a routable Layer 3 interface.

The CN-Series firewall is a container-native NGFW designed specifically for Kubernetes environments, deployable as containers and fully manageable by Panorama, enabling consistent policy enforcement across cloud-native and traditional network environments.

In PAN-OS service route configuration, IPSec tunnel-related traffic (such as IKE/IPSec control- plane communication) is, by default, sourced from the management interface unless explicitly overridden.
This includes:
- IKE negotiation traffic
- IPSec tunnel establishment and maintenance traffic