To clarify, based of a question of one of the posters here, I am guessing you want one connected virtual trunk (or LAN/untagged, VLAN99/tagged, VLAN10/tagged) to your pfSense VM so all traffic in an out are expected to be tagged/untagged as normal with no adjustments by VMware, is this correct? Typically to do all VLANs and pass tagging to the VM, you would use VLAN 4095 on the host level, I have never tested using the VLAN trucking selection option in the dvSwitch setting. I have done this once a long time ago and had no issues (but tested with just all tagging with Avaya and Cisco gear). However, research shows that you would be better off letting VMware Host accept the tag and process it for you, sending the VM the untagged packet. Is this just an exercise?
I believe by default Cisco sends VLAN 1 as untagged (native) when you create a trunk, so specifying is redundant, otherwise if it was a different value, the show config would have noted the different setting. But these are my recollections if it's IOS.
When you have this setup up on the trunk port, do any of the VLANs ping at all? I guess I am asking for connectivity status for each VLAN from the pfSense perspective. Do you have CDP enabled and confirmed the port/switch connectivity? I know dumb question, but have to get the simple ones out of the way first.
I ask all this, because I found this note:
"Caution: Native VLAN ID on ESXi/ESX VST Mode is not supported. Do not assign a VLAN to a port group that is same as the native VLAN ID of the physical switch. Native VLAN packets are not tagged with the VLAN ID on the outgoing traffic toward the ESXi/ESX host. Therefore, if the ESXi/ESX host is set to VST mode, it drops the packets that are lacking a VLAN tag."
Trying not using the Native VLAN on the Cisco, try create VLAN 2 on the switch (if it doesn't exist) and then set the native VLAN to 2 instead of the default of 1.