Why would what worked in Sophos would not work with PA

[A.Roytman]

Hello everyone,

Trying to make my ubiquity unifi access points with multiple ssid tagged with their  own vlan IDs work with PA. it worked seamlessly with Sophos but can't make it work with PA. 

I have one Ethernet port L3 configured with subnet DHCP, DNS and assigned to office zone. Acces points are connected to it via smart switch which is in no vlan mode

I created a sub interface with its own subnet, DNS,DHCP tagged with vlan=3 with is security zone "iot" with nat and security policies to external interface.

On unifi side I created a network tagged 3 and created ssid with it

I believe unifi needs Ethernet and default network be untagged. And any additional networks tagged.

It is basically what I had with Sophos 

My wifi client can connect and obtain DHCP info and from firewall I can ping internet from subinterface but Wi-Fi can't complete connection successfully and no access shows up in iot zone

What am I missing?

Thanks 

Alex