https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/virtual-systems/customize-service- routes-for-a-virtual-system/customize-service-routes-to-services-for-virtual-systems

There are two SD-WAN options:
- Pan-OS SD-WAN which requires a subscription and leverages existing firewalls
- Cloudgenix SD-WAN which requires ION devices (hardware)
Reference: https://docs.paloaltonetworks.com/sd-wan/1-0/sd-wan-admin/sd-wan-overview/about- sd-wan.html

High dataplane CPU utilization is often related to the processing power required for handling decryption tasks. Decrypting traffic (e.g., SSL or TLS traffic) consumes significant CPU resources because the firewall needs to inspect and decrypt encrypted traffic to apply security policies.
Reducing the amount of decrypted traffic can help lower the load on the dataplane CPU.

SSL/TLS service profiles specify a server certificate and a protocol version or range of versions for firewall or Panorama services that use SSL/TLS (such as administrative access to the web interface). By defining the protocol versions, the profiles enable you to restrict the cipher suites that are available for securing communication with the client systems requesting the services.
https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/device/device- certificate-management-ssltls-service-profile.html

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkiCAC