Kinda late I know…but if you are using ESX...you just use VGT to allow VLAN Tagging through to the guest OS (pfSense). To do this, you setup a Virtual Switch with a VLAN ID number of 4095 - this means that all VLAN info will bypass the standard VMware and be passed right through to the guest.
I use this instead of Virtual IPs because these IPs are pingable (the Virtual IP ones are not because of the way that ESX handles the CARP stuff from pfsense)
I am doing this here with great success.
Also, I would recommend changing your NIC to use the e1000 adapter instead of the standard one.
Jim