... at least one port must be configured as tagged (trunk) port to allow the VMs traffic.