I ran across the same issue today and found another/better way to use tagging if you have vCenter and the VMware vCenter plug-in for panorama. Details for configuring the plug-in can be found at Panorama Plugin for VMware vCenter .
Instead of using the 'Notes' field, you can use the vCenter 'Tag and Categories' feature. It is located under 'Menu > Tags & Custom Attributes'. In my example, I use vCenter Tags to create Dynamic groups in Panorama using the following categories; security-zone, site-or-location and domain-member.
FYI: If you don't see the Tags widget in vCenter, you may need to scroll down.
There are two pieces to the vCenter Tag configuration; Categories and Tags. Categories are groups of tags and also control if a VMware entity, in our case the 'VirtualMachine', can have more than one Tag from the Category.
For example, the Tags for the "domain-member" category are domain-client, domain-server and domain-controller. Multiple Cardinality is set to false (see above) and Associable Entities is set to VirtualMachines, so you can only select one Tag and the Tags are only available for Virtual Machines.
Once you have your categories and tags defined, apply them to your virtual machines by clicking Assign in the Tags widget for the Virtual Machine. To manually synchronize the Tags use the VMware vCenter plug-in.
Now when you create dynamic address group, you should see your tags available.
TIPS:
-You can use (parenthesis) to group multiple ANDs & ORs
-You can add Panorama Tags to dynamic address groups for use in other static or dynamic groups.
Hope you find this useful,
Sully
