A virtual wire logically binds two Ethernet interfaces together, allowing for all traffic to pass between the interfaces, or just traffic with selected VLAN tags (no other switching or routing services are available). You can create virtual wire subinterfaces to classify traffic according to an IP address, IP range, or subnet. A virtual wire requires no changes to adjacent network devices.
A virtual wire can bind two Ethernet interfaces of the same medium (both copper or both fiber optic), or bind a copper interface to a fiber optic interface.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects-services

Select this option (enabled by default) to share all Panorama shared objects and device-group- specific objects with managed firewalls.
If you disable this option, the appliance checks Panorama policies for references to address, address group, service, and service group objects, and does not share any unreferenced objects.
This option reduces the total object count by ensuring that the appliance sends only necessary objects to managed firewalls.
If you have a policy rule that targets specific devices in a device group, then the objects used in that policy are considered used in that device group.

Universal -By default, all the traffic destined between two zones, regardless of whether it is from the same zone or different zone. Universal rule types apply to all matching interzone and intrazone traffic in the specified source and destination zones.

Drop silently drops the packet, while deny gives an update.