For large lists of specific URLs, creating acustom URL categoryand importing the list is the most efficient approach for granular URL filtering.
"You can create custom URL categories to define specific URLs or patterns and enforce policies for these categories. This is the most efficient way to handle large sets of URLs." (Source: Custom URL Categories) This approach saves time compared to manual rule creation or using generic application filters.

Applications and threats
Panorama can push application and threat signature updates to managed firewalls, ensuring consistent application and threat visibility.
"Panorama uses dynamic updates to distribute the latest application and threat signature packs to all managed firewalls." (Source: Manage Content Updates in Panorama) WildFire Panorama also distributes WildFire signature updates to firewalls for real-time malware detection.
"WildFire updates provide the latest malware signatures to enhance detection and prevention, and can be deployed to all managed firewalls via Panorama." (Source: WildFire and Dynamic Updates)

When usingAWS centralized deploymentsfor Cloud NGFW, the service deploys NGFW instances into selected VPCsas additional workloads to secure that traffic.
"In centralized deployments, Cloud NGFW instances are deployed as security appliances within the selected VPCs, ensuring consistent traffic inspection and protection." (Source: Cloud NGFW Deployment Models) This approach minimizes complexity and ensures direct security policy enforcement within AWS.

Palo Alto Networks requires upgrading to thenext major feature releasebefore moving to newer releases.
This ensures stability and compatibility.
"When upgrading across multiple major PAN-OS releases, you must upgrade to each intermediate major feature release. Skipping major releases is not supported." (Source: Upgrade Considerations) For PAN-OS 9.1 # 11.2, the proper path is:
9.1 # 10.0 # 11.2

Blocking non-compliant SSH versionsandfailing certificate validationsare fundamental security measures:
Block sessions when certificate validation fails
"The SSH Proxy profile should block sessions that fail certificate validation to ensure that only trusted hosts are allowed." (Source: SSH Proxy Decryption Best Practices) Block connections using non-compliant SSH versions Older SSH versions may have vulnerabilities or lack modern encryption algorithms.
"To enforce stronger security, block SSH sessions that use older or deprecated versions of the SSH protocol that do not comply with your security posture." (Source: SSH Decryption and Best Practices) Together, these measuresminimize the risk of MITM attacksand secure SSH traffic.