There are errors in the port-channel between the distribution switch and the nexus, specifically the port that goes through Palo Alto. This is causing the traffic to continuously change between the direct link and the Palo Alto link, causing the devices connected to the distribution switch to lose connection to the network while the LACP is renegotiated.
I need to know how to troubleshoot a Vwire interface
so you only have a vwire on one link of the aggregate?
debug dataplane packet-diag set filter match ingress-interface ethernet1/x non-ip only debug dataplane packet-diag set filter match ingress-interface ethernet1/y non-ip only debug dataplane packet-diag set filter on show counter global filter delta yes packet-filter yes (repeat)