Reference: https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-licenses-and-updates
/deploy-updates-to-firewalls-log-collectors-and-wildfire-appliances-using-panorama/schedule-a-content- update-using-panorama.html

https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/manage-firewalls/manage-device-groups
/create-objects-for-use-in-shared-or-device-group-policy

The size of the NAT pool should be equal to the number of internal hosts that require address translations. By default, if the source address pool is larger than the NAT address pool and eventually all of the NAT addresses are allocated, new connections that need address translation are dropped. To override this default behavior, use Advanced (Dynamic IP/Port Fallback) to enable the use of DIPP addresses when necessary

Reference: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/device/device- dynamicupdates