https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption- concepts/decryption-mirroring
- the decryption, storage, inspection, and/or use of SSL traffic is governed in certain countries and
- user consent might be required in order to use the decryption mirror feature.
- Additionally, use of this feature could enable malicious users with administrative access to the firewall to harvest usernames, passwords, social security numbers, credit card numbers, or other sensitive information submitted using an encrypted channel.
- Palo Alto Networks recommends that you consult with your corporate counsel before activating and using this feature in a production environment.

In order to update Antivirus signatures through Dynamic Updates, an Antivirus license must be installed on the firewall. Without the appropriate license, the firewall will not be able to download or install the updates for Antivirus. The Threat Prevention subscription includes features like IPS and Anti-Spyware, but for Antivirus updates to appear in Dynamic Updates, the specific Antivirus license must be activated.

Set up the backup control link connection.
1. In Device > High Availability > General, edit the Control Link (HA1 Backup) section.
2. Select the HA1 backup interface and set the IPv4/IPv6 Address and Netmask.
Note: Use the management port for the HA1 link.
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/high-availability/set-up- activepassive-ha/configure-activepassive-ha

The direction of the policy matches the ingress zone and the zone where the server is physically located.
The security policy refers to the IP address in the original packet, which has a destination address of 192.0.2.100.
The firewall forwards the packet to the server out egress interface Ethernet1/2. The destination address is changed to 10.1.1.100 as the packet leaves the firewall.
For this example, address objects are configured for webserver-private (10.1.1.100) and Webserver-public (192.0.2.100). The configured NAT rule would look like this:

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/nat/nat-configuration- examples/destination-nat-exampleone-to-one-mapping.html#ide8f6a4b3-f875-4855-acb5-
5fd9ad918d04