topic PA supports 802.1ad QinQ? in General Topics

PA supports 802.1ad QinQ?

BigPalo — Wed, 10 Jul 2019 09:49:29 GMT

Hi,

I would like to know if PAs support 802.1ad (QinQ? any info about this?

Re: PA supports 802.1ad QinQ?

BPry — Wed, 10 Jul 2019 19:15:14 GMT

802.1ad was rolled into the 802.1Q standard in 2011, so the firewall should support this without issue as they have full 802.1Q compliance.

Re: PA supports 802.1ad QinQ?

jvalentine — Wed, 10 Jul 2019 20:55:08 GMT

Depends on your definition of "support".

My understanding is that today, if you use 0x88A8 ethertype, PAN-OS will treat that as an unknown ethertype and the traffic will receive the same action as any other non-IP protocol (ie: v-wire/L2 will flood w/o setting up flows). In 8.0, PAN-OS gained the ability to block this using Zone Protection. There is some limited support when using nested 0x8100 tags, but only for using the outer VLAN.

If you're looking for more functionality than this, please contact your Palo Alto Networks SE and request to be added to the QinQ feature request, along with the specific functionality required.