The template stack should consist of four templates arranged according to the diagram. The template values that will be configured on the firewall if each template has an SSL/TLS Service profile configured named Management will be the values in Chicago. This is because the SSL/TLS Service profile is configured in the Chicago template, which is the highest priority template in the stack. The firewall will inherit the settings from the highest priority template that has the setting configured, and ignore the settings from the lower priority templates that have the same setting configured. Therefore, the values in Datacenter, efwOlab.chi, and Global Settings will not be applied to the firewall. References:
* [Manage Templates and Template Stacks]
* [Template Stack Configuration]
* [Template Stack Priority]

https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/manage-firewalls/transition-a-firewall-to- panorama-management/migrate-a-firewall-to-panorama-management Push the configuration bundle from Panorama to the newly added firewall to remove all policy rules and objects from its local configuration. This step is necessary to prevent duplicate rule or object names, which would cause commit errors when you push the device group configuration from Panorama to the firewall in the next step.

When dealing with a false positive, particularly for a spyware threat detected through DNS queries (as indicated by the category "dns-c2"), the correct course of action involves creating an exception in the Anti- Spyware profile, not the Vulnerability Protection profile. This is because the Anti-Spyware profile in Palo Alto Networks firewalls is designed to detect and block spyware threats, which can include command and control (C2) activities often signaled by DNS queries.
The steps to configure an exception for this specific spyware signature (threat ID: 1000011111) are as follows:
* Navigate to Objects > Security Profiles > Anti-Spyware. This is where all the Anti-Spyware profiles are listed.
* Select the related Anti-Spyware profile that is currently applied to the security policy which is generating the false positive.
* Within the profile, go to the DNS Exceptions tab. This tab allows you to specify exceptions based on DNS signatures.
* Search for the related threat ID (in this case, 1000011111) and click enable to create an exception for it.
By doing this, you instruct the firewall to bypass the detection for this specific signature, effectively treating it as a false positive.
* Commit the changes to make the exception active.
By following these steps, the administrator can effectively address the false positive without disabling the overall spyware protection capabilities of the firewall.