To satisfy that requirement,
beginning with PAN-OS 10.2.1 and SD-WAN Plugin 3.0.1, you can have
an
SD-WAN hub or branch copy
the ToS field from the inner IPv4 header to the outer VPN header
of encapsulated packets going through the VPN tunnel. The ToS field
can contain ToS bits or DSCP markings. The
Copy ToS Header
option
also copies the Explicit Congestion Notification (ECN) field.