PA-1420 QinQ

smzr34 — Fri, 27 Dec 2024 18:55:11 GMT

Does the PA-1420 support QinQ tagging terminating at the Firewall? We have a L2 connection with an ISP to Azure and they require QinQ tagging. We do not have an ISR or other router to do it for us at this time.

Thanks,

Steve

Re: PA-1420 QinQ

JayGolf — Thu, 02 Jan 2025 20:59:56 GMT

Hi @smzr34 ,

The firewall cannot fully terminate or decapsulate both VLAN tags in a QinQ setup. This means it cannot strip the outer tag and forward traffic based on the inner tag. However, it can match and process traffic based on the outer VLAN tag if you configure your fw in vwire. A palo in vwire will forward QinQ traffic to pass through while preserving the inner tag.

There is a feature request for QinQ support right now, but it has been open for many years. I’d recommend reaching out to your SE. They can document your requirements and help you register a vote for the feature. That said, the general industry practice is to leverage high-end routers or switches for advanced Layer 2 functions like QinQ, which might explain why this hasn’t been a primary focus for firewalls.

Hope this helps!

topic PA-1420 QinQ in General Topics

PA-1420 QinQ

Re: PA-1420 QinQ