vSPU

Following is a diagram and the associated configuration. In the diagram, the blue square represents the PF. The dotted line represents the VF. Two VFs are defined for each PF. The configuration uses VLANs 1000 and 1001 to direct the traffic between VF and PF. The VM is unaware of the VLAN.

VLAN 1000 and VLAN 1001 are on opposites sides of the firewall. However, as this is presented to the VM as four devices, you can use link aggregation across the two PFs to cater for an element of resiliency.

The vSPU deployment negates the need for balancing interrupt requests and traffic is balanced across the vSPUs based upon IP headers.

FortiGate vSPU describes balancing the traffic with vSPU. It does not require the configuration to use a balancing technique.