By default, the firewall uses the management interface to communicate with various servers including those for External Dynamic Lists (EDLs), DNS, email, and Palo Alto Networks updates servers. The management interface also is used to communicate with Panorama. Service routes are used so that the communication between the firewall and servers goes through the data ports on the data plane. These data ports require appropriate Security policy rules before external servers can be accessed.

Create a Zone Protection profile for the firewalls in the data center template (T_DataCenter).
Select the Network tab and, in the Template drop-down, select T_DataCenter.
Select Network ProfilesZone Protection and click Add.