The tagging mode that is required is Virtual Guest Tagging (VGT), which allows VLAN tagging to be done at the VM level. VGT requires that the VLAN ID on the switch port group be set to 4095, which is a special value that indicates that packets from all VLANs are allowed to pass through. Reference: https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.networking.doc/GUID-D35A0A1C-B638-4819-A099-E3A8D18F7CC8.html https://kb.vmware.com/s/article/1003806