https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/manage-log- collection/configure-log-forwarding-to-panorama

If some sites cannot be decrypted due to technical reasons, such as unsupported ciphers, and blocking them is not an option, then the engineer should add the sites to the SSL Decryption Exclusion list to exempt them from decryption. The SSL Decryption Exclusion list is a predefined list of sites that are not subject to SSL decryption by the firewall. The list includes sites that use certificate pinning, mutual authentication, or unsupported cipher suites. The engineer can also add custom sites to the list if they have a valid business reason or technical limitation for not decrypting them34. Adding the sites to the SSL Decryption Exclusion list will allow the traffic to pass through without being decrypted or blocked by the firewall. Reference: SSL Decryption Exclusion, Troubleshoot Unsupported Cipher Suites

Explanation
https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/administer-panorama/enable-automated-com The Automated Commit Recovery feature enables the firewall to automatically revert to a previous configuration if a commit operation causes connectivity loss between the firewall and Panorama. The feature performs a connectivity check between the firewall and Panorama after every configuration commit on the firewall. If the check fails, the firewall reverts to the last known good configuration and restores connectivity with Panorama. The feature does not restore the running configuration on a firewall or Panorama if the last commit fails, as this would require manual intervention. The feature does not revert the configuration changes on Panorama, as Panorama is not affected by the commit operation on the firewall. References:
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/panorama-features/automatic-panoram
https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/administer-panorama/enable-automate