On KVM with SR-IOV interfaces and packet mode, VRRP may come up fine initially between 2 vSRX instances running packet mode with SR-IOV interfaces.

Issue may be triggered when interface is shut off for primary or primary router is rebooted and then VRRP advertisements reception stops.

This issue is not seen with VirtIO interfaces.

On KVM, with SR-IOV interfaces and packet mode, VRRP does not work as expected; VRRP may come up initially however it may run into issues.

With VirtIO interfaces, it behaves as expected and vSRX-secondary switches from master to backup state when vSRX-primary is reactivated again.

This is a limitation with SR-IOV interfaces on KVM with trust mode disabled.

The following vSRX Virtual Firewall features are not supported in deployments that use SR-IOV interfaces:
These limitations apply in deployments where the PF drivers cannot be updated or controlled.
The limitations do not apply when vSRX Virtual Firewall is deployed on supported Juniper Networks devices.
High availability (HA)
IRB interfaces
IPv6 addressing
Jumbo frames
Layer 2 support
Multicast with other features such as OSPF and IPv6
Packet mode

Please use this command on KVM server (CLI) to check trust mode for SR-IOV interfaces :
# ip link show <interface_name>
[root@KVM-server ~]# ip link show ens5f0
5: ens5f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
  link/ether 0c:c4:7a:ea:98:fe brd ff:ff:ff:ff:ff:ff
  vf 0 MAC be:f3:44:bd:64:d7, spoof checking on, link-state auto, trust off, query_rss off
  vf 1 MAC 00:00:00:00:00:00, spoof checking on, link-state auto, trust off, query_rss off

Please refer : Limitations for SR-IOV interfaces with trust mode disabled

2025-03-25 : Article Created

2025-08-15 : Added condition 'with trust mode disabled' and commands to verify trust mode.