In PAN-OS service route configuration, IPSec tunnel-related traffic (such as IKE/IPSec control- plane communication) is, by default, sourced from the management interface unless explicitly overridden.
This includes:
- IKE negotiation traffic
- IPSec tunnel establishment and maintenance traffic

Basic Concept: Admin Role Profiles implement role-based administrative access on PAN-OS. They define exactly which management operations an administrator may perform.
Why C is Correct: Granular task permissions are correct because Admin Role Profiles limit administrator capabilities rather than enabling MFA or unrestricted access.
Why A is Wrong: Allow access to all resources without restrictions. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.
Why B is Wrong: Enable multi-factor authentication (MFA) for administrator access. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.
Why D is Wrong: Restrict access to sensitive report data. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Basic Concept: Logical routers are available only after Advanced Routing is enabled globally. This is a general setting change on the firewall.
Why D is Correct: Checking advanced routing in General settings is the required first action before logical router objects can be configured.
Why A is Wrong: Changing the virtual router type from "default" to "advanced" is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.
Why B is Wrong: Activating an advanced routing subscription is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.
Why C is Wrong: Committing a new advanced routing software module is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.

Basic Concept: When interoperating with policy-based VPN devices such as Cisco ASA or Check Point, Proxy IDs identify the local and remote selectors that must match Phase 2/IPSec SAs.
Why B is Correct: Matching Proxy IDs resolves the failure because the ASA expects specific encryption domains; without matching selectors, IKE Phase 2 negotiation fails or traffic does not match the correct SA.
Why A is Wrong: Ensure that an active static or dynamic route exists for the VPN peer with next hop as the tunnel interface. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Why C is Wrong: Check that IPSec is enabled in the management profile on the external interface. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Why D is Wrong: Validate the tunnel interface VLAN against the peer's configuration. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

GlobalProtect provides accurate, timely mappings by requiring user authentication on network changes, device posture shifts, or logon events, using both internal and external gateways for comprehensive coverage across remote and on-premises users without relying on external agents or syslog delays.