The interface ethernet1/15 is configured as a layer 3 interface. Subinterfaces corresponding to each one of the VLAN are created off of the parent interface Ethernet 1/15. Each subinterface is assigned a VLAN tag and an IP address corresponding to the VLAN provides connectivity.

Note: Inter VLAN routing with each VLAN in a unique IP subnet In order for network devices in different VLANs to communicate, a router must be used to route traffic between the VLANs. While VLANs help to control local traffic, if a device in one VLAN needs to communicate with a device in another VLAN, one or more routers must be used for inter VLAN communication. In this configuration a Palo Alto networks firewall can used to securely route traffic within the VLAN. This is also commonly called "one arm routing" or "router on a stick".

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clp3CAC

B: The show panorama-status command shows the Panorama connection status.
Sample Output
The following command shows information about the Panorama connection.
username@hostname> show panorama-status
Panorama Server 1 : 10.1.7.90
State : Unknown
username@hostname>
D: Issue
The Managed Devices show not connected to Panorama and are not able to establish a new connection to Panorama.
The Packet Capture on Panorama Management Interface shows SYN packets received from devices on port 3978, but no SYN ACK is sent from Panorama.
> tcpdump filter "port 3978"
> view-pcap mgmt-pcap mgmt.pcap
https://live.paloaltonetworks.com/t5/Management-Articles/Managed-Devices-Unable-to-Establish- Connections-to-Panorama/ta-p/53248
https://www.paloaltonetworks.jp/content/dam/paloaltonetworks-com/en_US/assets/pdf/technical- documentation/pan-os-5x/CLI_Reference_Guide-Panorama-5.1_PAN-OS-5.0.pdf

Enterprise CA-signed Certificates-An enterprise CA can issue a signing certificate that the firewall can use to sign the certificates for sites which require SSL decryption. When the firewall trusts the CA that signed the certificate of the destination server, the firewall can send a copy of the destination server certificate to the client, signed by the enterprise CA. This is a best practice because usually all network devices already trust the Enterprise CA (it is usually already installed in the devices' CA Trust storage), so you don't need to deploy the certificate on the endpoints, so the rollout process is smoother.
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/configure-ssl-forward- proxy.html