As stated is still uses PPPoE; If you can tag traffic as VLAN 35 on the interface of the Palo Alto box, you can go directly from the Alcatel-Lucent ONT they'll give you to the firewall. This will skip the Sagemcom 2864 they provide.
I go from this box to my pfsense box so hopefully your firewall can do PPPoE on the interface.
Thanks guys. Yeah the 'wall will do PPPoE on the interface. I just need to tag traffic I guess, so that's no issue. But.. the fibre connection coming in is an 802.1q tag, is it? So am I right in saying that I could connect the media converter / ONT into a switch which can split VLAN 35 and 36 (TV) off, then hook my FW to a switchport on VLAN 35?