Hey guys just wanted to share that I ordered an SG-1100 rental unit to play with for a couple of weeks.
Not telling what to do – if you want to play around. I have pfsense running inside xcp-ng (different hypervisor) and things work, although yes there was a step I had to complete to provision the hypervisor to know about the VMs. I know you were working if vmware, however I think you’ve hit the nail on the head – the hypervisor needs to be configured to pass the tag information along or somehow it just gets lost.
@kevdog
Thanks for sharing your info, which adds to my belief that this was in fact the issue. I ordered the SG-1100 rental to be able to do what I contemplated on doing with the VM setup above: fiddle with settings, ultimately to decide whether or not to buy a pfSense capable box to replace my USG. This also buys me some time to find a model that fits my requirements, which probably exceed the SG-1100 specs.