You can deploy a single instance of the VM-Series firewall
per Linux host (single tenant) or multiple instances of the VM-Series
firewalls on a Linux host. The VM-Series firewall can be deployed
with virtual wire, Layer 2, or Layer 3 interfaces. If you plan on
using SR-IOV capable interfaces on the VM-Series firewall, you can only
configure the interfaces as Layer 3 interfaces.