I use Palo Alto Networks Panorama for the management of all the firewalls. Apart from that, I use Cloud Prisma for VPN management, as well as connectivity to the production, non-production environment. I use three flavors of Palo Alto Networks: Panorama, Cloud Prisma, and the on-prem, physical Palo Alto firewalls in the data centers.
I use Palo Alto Networks Panorama for all our production, non-production firewalls, which are onboarded on Panorama. Whatever changes I make in the individual firewall, I push that to the Panorama, and Panorama pushes to the individual devices.