NAT Policy Rule Functionality
Upon ingress, the firewall inspects the packet and does a route lookup to determine the egress interface and zone. Then the firewall determines if the packet matches one of the NAT rules that have been defined, based on source and/or destination zone. It then evaluates and applies any security policies that match the packet based on the original (pre-NAT) source and destination addresses, but the post-NAT zones.
https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-networking-admin/nat/nat-policy-rules/nat- policy-overview

Use only signed certificates, not CA certificates, in SSL/TLS service profiles.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/certificate-management/configure- an-ssltls-service-profile

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos- protection/zone-defense/packet-buffer-protection

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/service-routes/service- routes-overview#id69ef535a-d5b0-4c79-bb7f-1302a438e7c5
"The service packets exit the firewall on the port assigned for the external service and the server sends its response to the configured source interface and source IP address."

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clp3CAC Decide which port you want to use for access to external services and connect it to your switch or router port.
The interface you use must have a static IP address.