You can configure Packet Buffer Protection at two levels: the device level (global) and if enabled globally, you can also enable it at the zone level. Global packet buffer protection (Device > Setup > Session) is to protect firewall resources and ensure that malicious traffic does not cause the firewall to become non-responsive.
Packet buffer protection per ingress zone (Network > Zones) is a second layer of protection that starts blocking the offending IP address if it continues to exceed the packet buffer protection thresholds. The firewall can block all traffic from the offending source IP address. Keep in mind that if the source IP address is a translated NAT IP address, many users can be using the same IP address. If one abusive user triggers packet buffer protection and the ingress zone has packet buffer protection enabled, all traffic from that offending source IP address (even from non-abusive users) can be blocked when the firewall puts the IP address on its block list.
The most effective way to block DoS attacks against a service behind the firewall is to configure packet buffer protection globally and per ingress zone. You can Enable Packet Buffer Protection for a zone, but it is not active until you enable packet buffer protection globally and specify the settings.
Reference:
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos- protection/configure-zone-protection-to-increase-network-security/configure-packet-buffer- protection

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSvCAK

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/getting-started/best-practices-for- securing-administrative-access

Enterprise CA-signed Certificates-An enterprise CA can issue a signing certificate that the firewall can use to sign the certificates for sites which require SSL decryption. When the firewall trusts the CA that signed the certificate of the destination server, the firewall can send a copy of the destination server certificate to the client, signed by the enterprise CA. This is a best practice because usually all network devices already trust the Enterprise CA (it is usually already installed in the devices' CA Trust storage), so you don't need to deploy the certificate on the endpoints, so the rollout process is smoother.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/configure-ssl-forward- proxy

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/monitoring/use-the-application- command-center/ widget-descriptions.html