https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/panorama-web- interface/panorama-managed-devices-summary/panorama-managed-devices-health

When an interface is configured as virtual wire, the routing table is not checked by the FW. If it enters one interface, it has to exit the other interface of the virtual wire, there is no exception.

Data Link - The HA2 link is used to synchronize sessions, forwarding tables, IPSec security associations and ARP tables between devices in an HA pair. Data flow on the HA2 link is always unidirectional (except for the HA2 keep-alive); it flows from the active device to the passive device.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/high-availability/ha-concepts/ha- links-and-backup-links

https://knowledgebase.paloaltonetworks.com/servlet/rtaImage?eid=ka10g000000U0KT&feoid=00 N0g000003VPSv&refid=0EM0g000001Ja97

Make sure Panorama is running the same or a later PAN-OS version than you are upgrading to.
You must upgrade Panorama and its Log Collectors to 10.2 before upgrading the managed firewalls to this version. In addition, when upgrading Log Collectors to 10.2, you must upgrade all Log Collectors at the same time due to changes in the logging infrastructure.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-upgrade/upgrade-pan-os/upgrade-the- firewall-pan-os/upgrade-firewalls-using-panorama