Explanation
https://docs.paloaltonetworks.com/wildfire/9-0/wildfire-admin/wildfire-overview/wildfire-concepts/wildfire-sign

In a Palo Alto Networks Next-Generation Firewall (NGFW), supporting asymmetric routing with redundancy requires specific features to handle traffic that may not follow the same path in both directions.
* Active / active high availability (HA): This feature allows two firewalls to operate in tandem, sharing the traffic load. Active/active HA mode is designed to handle asymmetric routing scenarios where traffic might ingress through one firewall and egress through another, ensuring continuity and redundancy.
* non-SYN first packet: This feature is crucial for dealing with non-standard traffic patterns where the initial packet may not always be a SYN packet (typical in TCP connections). It allows the firewall to handle and correctly process such packets, which is essential in asymmetric routing scenarios.

Palo Alto Networks uses proprietary technologies to identify and control traffic sources regardless of IP address or network segment. These technologies include:
* User-ID (A): This technology maps IP addresses to user identities, allowing policies to be enforced based on user or group identity rather than just IP addresses. This is especially useful in dynamic environments where IP addresses can change frequently.
* Device-ID (A): This technology helps to identify and control devices accessing the network. It provides visibility into which devices are on the network and ensures that policies can be applied based on device type and identity.
References:
* Palo Alto Networks, User-ID and Device-ID Documentation.
* Palo Alto Networks, Technology Whitepapers.