https://docs.paloaltonetworks.com/best-practices/10-1/dos-and-zone-protection-best- practices/dos-and-zone-protection-best-practices/follow-post-deployment-dos-and-zone- protection-best-practices Measure firewall performance to ensure it's within acceptable norms and so you understand the effect of zone and DoS protection on firewall resources.
If the levels of zone and DoS protection (combined with other resource-consuming features such as decryption) consume too many firewall resources, the best practice is to scale up the resources rather than to compromise security.

The "Group Failure Condition" in the image is "all". If it said "any", then losing link on either interface would cause failover.
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/high-availability/ha- concepts/failover

The Group ID is part of the MAC address in a HA pair. Each pair of devices in a multi-cluster environment must have a unique Group ID in order to prevent duplicate MAC entries in upstream ARP tables. Changing the Group ID in one of these clusters should resolve the problem.

For IPsec VPN reliability, Option B enhances failover speed by adding a backup tunnel and tuning tunnel monitoring. Reducing the interval (e.g., to 2 seconds) and threshold (e.g., to 3 retries) ensures quick detection and failover to the backup tunnel, minimizing disruption.