According to Add SR-IOV Interfaces , SR-IOV must be added as a PCI adapter on vSRX. However, when an attempt is made to have VLAN tagged traffic flow through such a PCI adapter with SR-IOV interface, it does not work. This is because VMware lacks support for VLAN traffic on PCI devices.
According to VMware's document on Network Adapter Types , the PCI adapter needs to be added as an SR-IOV passthrough network adapter.
This article explains the procedure for adding SR-IOV as a network adapter on vSRX hosted on VMware that allows VLAN tagged traffic to pass through.
To have the SR-IOV passthrough option on your ESXi host, the minimum hardware version is 10.
Log in to vSphere Web Client.
Power off your VM (vSRX).
Go to the Manage tab > VM Hardware . Check the VM version in use:
If the version is 9 or earlier, go to the next step for upgrading it to VM version 10; else go to Step 8 .
Right-click the VM and select Compatibility > Upgrade VM Compatibility.
Based on the ESXi version, select any one of the two options shown: ESXi 5.5 and later (VM version 10) or ESXi 6.0 and later (VM version 11) .
The upgrade will be completed instantly and the new version will be displayed:
Step 7.1 - Note: This steps applies only to fresh vSRX installations. Power on the vSRX without adding SR-IOV NICs or making any changes to the existing 3x VMXNET3 NICs. After the vSRX is up, do not make any changes and just power it off again. Now proceed to Step 8 .
Click Edit at the top right. Select New device : Network and Add .
Expand New Network . From the drop-down for Adapter Type , select SR-IOV passthrough .
Select the desired physical function Allow from the Guest OS MTU Change drop-down.
Expand the Memory tab and select the check box Reserve all guest memory. Then click OK .
You can now power on the VM and it is ready to support SR-IOV with VLAN tagging on this new interface.
2020-09-22: Updated screenshot in Solution for Step 3
2021-12-09: Added step 7.1 applicable to fresh vSRX installations