The Advanced Routing Engine in Palo Alto Networks firewalls enhances the capabilities of routing functionalities, allowing for more complex and robust routing configurations. To enable the Advanced Routing Engine on a Palo Alto Networks firewall, an administrator needs to navigate to the Network tab, select Virtual Routers, and then access the settings for the specific virtual router they wish to configure.
Within the Router Settings under the General tab, there's an option to enable Advanced Routing features.
After enabling this option, the administrator must commit the changes and perform a system reboot for the changes to take effect. This process allows the firewall to utilize advanced routing protocols and features, enhancing its ability to manage and route traffic more efficiently across different network segments.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/quality-of-service/qos-concepts/qos- classes

User-ID is a feature that allows the firewall to identify and classify users and groups on the network based on their usernames, IP addresses, and other attributes1. User-ID information can be collected from various sources, such as:
A: Windows User-ID agent: A software agent that runs on a Windows server and collects user information from Active Directory domain controllers, Exchange servers, or eDirectory servers2. The agent then sends the user information to the firewall or Panorama for user mapping2.
B: GlobalProtect: A software agent that runs on the endpoints and provides secure VPN access to the network3. GlobalProtect also collects user information from the endpoints and sends it to the firewall or Panorama for user mapping4.
C: XMLAPI: An application programming interface that allows external systems or scripts to send user information to the firewall or Panorama in XML format. The XMLAPI can be used to integrate with third-party systems, such as identity providers, captive portals, or custom applications.

In Panorama, zones defined in a template must be linked to a device group for visibility in policy creation.
Adding the template as a reference template in the device group (Option B) ensures its zones are available in the policy editor's drop-down list.
Option A (master device) affects User-ID, not zones. Option C (add firewall) is a prerequisite, not a fix.
Option D (share objects) is unrelated to zones. Documentation specifies reference templates for this issue.
Reference: Panorama Administrator's Guide, PAN-OS 11.2, "Device Groups and Templates" section.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/manage-firewall- administrators/administrative-authentication#:~:text=The%20administrative%20accounts%20are%20defined, attributes%20on%20the%20SAML%20server.