https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/troubleshooting/test-policy-match-and-connectivity-for-managed-devices.html
After you successfully push the device group and template stack configurations to your firewalls, Log Collectors, and WF-500 appliances, test that the correct traffic matches the policy rules pushed to your managed devices and that your firewalls can successfully connect to all appropriate network resources.