When you have a VM that requires VLAN directly passed to it, it could be a virtual firewall or any Vm, VMWARE does not allow anything else that an untagged port to the VM.
This can be changed, by editing the vSwitch’s portgroup of the host, and change this:
You can see that the “VLAN ID (Optional):”, has been set to “All (4095)”, which means that all posible VLAN ID’s will be passed directly to the VM.
The VM has to meet the following requirements:
- 802.1Q VLAN trunking driver has to be loaded inside the virtual machine.
Source: VMware KB: Sample configuration of virtual machine VLAN Tagging (VGT Mode)