A. Configure a Policy Based Forwarding policy rule for the update server IP address so that traffic sourced from themanagement interfaced destined for the update servers goes out of the interface acting as your internet connection.

B. Configure a security policy rule to allow all traffic to and from the update servers.

C. Download and install application updates cannot be done automatically if the MGT port cannot reach the internet.

D. Configure a service route for Palo Alto networks services that uses a dataplane interface that can route traffic to the internet, and create a security policy rule to allow the traffic from that interface to the update servers if necessary.