PA supports 802.1ad QinQ?

[BigPalo]

Hi,

I would like to know if PAs support 802.1ad (QinQ? any info about this?

[BPry]

@BigPalo,

802.1ad was rolled into the 802.1Q standard in 2011, so the firewall should support this without issue as they have full 802.1Q compliance. 

[jvalentine]

Depends on your definition of "support". 

My understanding is that today, if you use 0x88A8 ethertype, PAN-OS will treat that as an unknown ethertype and the traffic will receive the same action as any other non-IP protocol (ie: v-wire/L2 will flood w/o setting up flows).  In 8.0, PAN-OS gained the ability to block this using Zone Protection.  There is some limited support when using nested 0x8100 tags, but only for using the outer VLAN.  

If you're looking for more functionality than this, please contact your Palo Alto Networks SE and request to be added to the QinQ feature request, along with the specific functionality required.