https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-auto-tagging-to-automate- security-actions

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/user-id/deploy-user-id-in-a-large- scale-network/share-user-id-mappings-across-vsys

A Custom Panorama Admin is a type of role-based access that allows a super user to create separate Panorama administrator accounts for each of the three contractors. This will allow each contractor to work with different device-groups in their hierarchy and deploy policies and objects in accordance with the organization's compliance requirements. The Custom Panorama Admin role also allows the super user to assign separate permissions to each contractor's account, granting them access to only the resources they are authorized to use. This type of role-based access is the most appropriate for this project as it will ensure that each contractor is only able to access the resources they need in order to do their job.

Protection profiles and DoS Protection policy rules combine to protect specific groups of critical resources and individual critical resources against session floods. Compared to Zone Protection profiles, which protect entire zones from flood attacks, DoS protection provides granular defense for specific systems, especially critical systems that users access from the internet and are often attack targets, such as web servers and database servers. Apply both types of protection because if you only apply a Zone Protection profile, then a DoS attack that targets a particular system in the zone can succeed if the total connections-per-second (CPS) doesn't exceed the zone's Activate and Maximum rates. DoS Protection is resource-intensive, so use it only for critical systems. Similar to Zone Protection profiles, DoS Protection profiles specify flood thresholds. DoS Protection policy rules determine the devices, users, zones, and services to which DoS Profiles apply.
https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/zone-protection-and-dos- protection/zone-defense/dos-protection-profiles-and-policy-rules

The log message "Received fatal alert UnknownCA from client" indicates that the client is unable to trust the certificate provided by the server because it was signed by an unknown or untrusted Certificate Authority (CA). This situation is typically seen in SSL/TLS decryption, where the firewall acts as a proxy and attempts to decrypt the traffic but encounters a certificate that it does not recognize.
Add the server's hostname to the SSL Decryption Exclusion List: This option allows the firewall to bypass decryption for this specific traffic, meaning the firewall will no longer attempt to decrypt the traffic and will allow it to pass through without interference. This solution is appropriate if the administrator determines that decryption of this traffic is unnecessary or problematic due to the untrusted certificate.