diff --git a/ansible/roles/vm_set/templates/sonic.xml.j2 b/ansible/roles/vm_set/templates/sonic.xml.j2
index 2e68977d503..b5f37a29def 100644
--- a/ansible/roles/vm_set/templates/sonic.xml.j2
+++ b/ansible/roles/vm_set/templates/sonic.xml.j2
@@ -133,4 +133,18 @@
 {% endif %}
   </devices>
   <seclabel type='dynamic' model='apparmor' relabel='yes'/>
+{% if asic_type == 'vpp' %}
+  {#
+    Disable the virtio-net control-VQ VLAN filter for VPP DUTs. VPP/DPDK drives the
+    NIC directly and never registers VLANs with the virtio control plane, so with the
+    qemu default (ctrl_vlan=on) qemu silently drops every VLAN-tagged frame before it
+    reaches VPP. That breaks any VLAN sub-interface / L3 sub-port dataplane test (e.g.
+    iface_loopback_action) while leaving untagged traffic working. libvirt has no
+    attribute for this control, so it is set via a qemu -global override.
+  #}
+  <qemu:commandline>
+    <qemu:arg value='-global'/>
+    <qemu:arg value='virtio-net-pci.ctrl_vlan=off'/>
+  </qemu:commandline>
+{% endif %}
 </domain>