Explanation
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/app-id-features/policy-optimizer his new feature identifies port-based rules so you can convert them to application-based rules that allow the traffic or add applications to existing rules without compromising application availability.
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/app-id-features/policy-optimizer.html

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/url-filtering/url-filtering- profile-actions

https://live.paloaltonetworks.com/t5/blogs/what-are-applications-and-services/ba-p/342508# A service on the Palo Alto Networks firewall is a TCP or UDP portes which port is open or closed and does not look beyond Layer 4. An application it goes into Layer 7 inspection to ascertain which application is active in a data flow and will enforce "normal" behavior onto it, DNS Query
https://live.paloaltonetworks.com/t5/blogs/what-are-applications-and-services/ba-p/342508#
Concept 1
A service on the Palo Alto Networks firewall is a TCP or UDP port, as it would be defined on a traditional firewall or access list. It simply defines which port is open or closed and does not look beyond Layer 4.
Concept 2
An application is what makes the Palo Alto Networks next-generation firewall so powerful; it goes into Layer 7 inspection to ascertain which application is active in a data flow and will enforce "normal" behavior onto it (e.g., a session identified as DNS that suddenly sends an SQL query is abnormal and will be blocked).

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/firewall-administration/manage- firewall-administrators/configure-administrative-accounts-and-authentication/configure-certificate- based-administrator-authentication-to-the-web-interface

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm1OCAS change the Group IDs in the High Availability settings to be different from the other firewall pair on the same subnet. This will prevent the MAC addresses from conflicting and allow the firewalls to properly route traffic. You can also configure a floating IP between the firewall pairs if necessary.