The Advanced Routing Engine (ARE) requires enabling its general setting as the first step before configuring any logical routers on a PAN-OS firewall.
Configuration Steps
Access Network > Routing > General and enable Advanced Routing to activate the ARE feature set, including logical router support. Only after this can logical routers be added under Network > Routing > Logical Routers.

Terraform is an Infrastructure-as-Code (IaC) tool that automates the provisioning and management of infrastructure resources, including Palo Alto Networks Next-Generation Firewalls (NGFWs). By using Terraform configuration files, administrators can define and deploy NGFW instances across cloud environments (such as AWS, Azure, and GCP) efficiently and consistently.
Terraform enables:
Automated firewall deployment in cloud environments.
Configuration of security policies and networking settings in a declarative manner.
Scalability and repeatability, reducing manual intervention in firewall provisioning.

Deploying multiple independent VM-Series firewalls across different Azure Availability Zones and placing them behind an Azure Load Balancer provides zone-level fault tolerance by design, ensuring traffic continues to flow if an entire zone fails, without relying on stateful HA dependencies or single-instance failover mechanisms.

NetFlow export requires the interface to operate in Layer 3 mode because it depends on IP routing and flow records derived from Layer 3 traffic, which are not available on interfaces configured as Layer 2, virtual wire, or other non-Layer 3 modes.

Portal authentication creates user-to-IP mappings through direct, interactive authentication from the user's device to the firewall itself, making it the most reliable method because the identity is verified in real time at the source rather than inferred from logs or external systems.