In PAN-OS 7.0, the VM-Series MAC address can be edited to match the vSphere assigned MAC address for the vNIC. This is useful for environments where editing the vNIC MAC address is not permitted. The ability to edit the VM-Series MAC address in PAN-OS 7.0 will only help for Layer 3 interfaces, but does not work for layer 2, vwire, or tap mode.
Cause
For layer 2, vwire, and tap interfaces, there will be many different destination MAC addresses and editing the vNIC MAC address will not solve the issue.
Resolution
The solution is to attach the VM-Series to a port group with promiscuous mode enabled (disabled by default.)