When administrative functions (licensing, updates) use a data plane interface, the firewall requires outbound connectivity to Palo Alto Networks servers (e.g., updates.paloaltonetworks.com) via that interface. If HTTPS
/SSH work but licensing/updates fail, the issue is likely upstream blocking or misrouting. Validating upstream devices (Option B) ensures ports (e.g., 443) and destinations are accessible, resolving the issue.