Depends on your definition of "support". My understanding is that today, if you use 0x88A8 ethertype, PAN-OS will treat that as an unknown ethertype and the traffic will receive the same action as any other non-IP protocol (ie: v-wire/L2 will flood w/o setting up flows). In 8.0, PAN-OS gained the ability to block this using Zone Protection. There is some limited support when using nested 0x8100 tags, but only for using the outer VLAN. If you're looking for more functionality than this, please contact your Palo Alto Networks SE and request to be added to the QinQ feature request, along with the specific functionality required.
... View more