https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/manage-log- collection/configure-log-forwarding-to-panorama

Define for the profile rule to match to unknown traffic and to forward samples for analysis based on:

https://docs.paloaltonetworks.com/wildfire/10-0/wildfire-admin/submit-files-for-wildfire- analysis/forward-files-for-wildfire-analysis.html

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/decryption-overview

Cause
The issue is seen when the HA1-backup is configured with either management (MGT) or an in- band interface.
The "Backup Peer HA1 IP Address" is not configured :
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UmPCAU&lang=en_US%E2%80%A9

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption- concepts/decryption-mirroring
- the decryption, storage, inspection, and/or use of SSL traffic is governed in certain countries and
- user consent might be required in order to use the decryption mirror feature.
- Additionally, use of this feature could enable malicious users with administrative access to the firewall to harvest usernames, passwords, social security numbers, credit card numbers, or other sensitive information submitted using an encrypted channel.
- Palo Alto Networks recommends that you consult with your corporate counsel before activating and using this feature in a production environment.