WildFire logs showing a "malicious" verdict with an "allow" action indicate that the initial traffic wasn't blocked in real-time, likely because the Antivirus profile isn't configured to act immediately on WildFire verdicts. By default, WildFire submits files for analysis, and signatures may take up to
24 hours to propagate globally unless real-time blocking is enabled. Configuring the Antivirus security profile (Option B) to "block" on malicious WildFire verdicts ensures that threats are blocked within minutes once the verdict is returned (typically 5-15 minutes), leveraging WildFire's real-time signature updates.

When a Threat ID isn't visible in the Vulnerability Protection profile's Exceptions tab, selecting
"Show all signatures" (Option B) reveals all available threat signatures, including those not recently triggered, allowing the administrator to add an exception efficiently. This is the fastest way to resolve false positives without external assistance.

You can only assign a single VLAN to a subinterface, and not to the physical interface. Each subinterface must have a VLAN ID before it can pass traffic.
http://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/intrface.htm l

Reasons that sites break decryption technically include pinned certificates, client authentication, incomplete certificate chains, and unsupported ciphers.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/decryption- exclusions/exclude-a-server-from-decryption

Palo Alto Networks best practices dictate upgrading Panorama-managed environments in this order:
Panorama first, then log collectors, and finally firewalls. Panorama must be on the latest (or compatible) version to manage upgraded devices and push configurations. Log collectors follow to ensure log compatibility, and firewalls last to maintain operational continuity.