PA-1420 QinQ

[smzr34]

Does the PA-1420 support QinQ tagging terminating at the Firewall? We have a L2 connection with an ISP to Azure and they require QinQ tagging. We do not have an ISR or other router to do it for us at this time.

Thanks,

Steve 

[JayGolf · Accepted solution]

Hi @smzr34 ,

The firewall cannot fully terminate or decapsulate both VLAN tags in a QinQ setup. This means it cannot strip the outer tag and forward traffic based on the inner tag. However, it can match and process traffic based on the outer VLAN tag if you configure your fw in vwire. A palo in vwire will forward QinQ traffic to pass through while preserving the inner tag.

There is a feature request for QinQ support right now, but it has been open for many years. I’d recommend reaching out to your SE. They can document your requirements and help you register a vote for the feature. That said, the general industry practice is to leverage high-end routers or switches for advanced Layer 2 functions like QinQ, which might explain why this hasn’t been a primary focus for firewalls.

Hope this helps!