diff --git a/install_config/group_vars/all.yml b/install_config/group_vars/all.yml
index 5947356..295a37d 100644
--- a/install_config/group_vars/all.yml
+++ b/install_config/group_vars/all.yml
@@ -3,7 +3,7 @@
 tsg_access_type: 0
 
 #####0: Tun_mode;  1: ADC;
-tsg_runnning_type: 0 
+tsg_running_type: 0 
 
 ########################################
 maat_redis_server:
@@ -73,6 +73,9 @@ mrtunnat:
 
 nic_data_incoming:
   name: enp1s0
+  vf0_name: enp1s2
+  vf1_name: enp1s2f1
+  vf2_name: enp1s2f2
 
 VlanFlipping:
   vlanID_1: 100
diff --git a/roles/firewall/templates/capture_packet_plug.conf.j2 b/roles/firewall/templates/capture_packet_plug.conf.j2
index 8b4fd1c..9cd6d10 100644
--- a/roles/firewall/templates/capture_packet_plug.conf.j2
+++ b/roles/firewall/templates/capture_packet_plug.conf.j2
@@ -15,7 +15,7 @@ INC_CFG_DIR=capture_packet_rule/inc/index/
 FULL_CFG_DIR=capture_packet_rule/full/index/
 
 [LOG]
-{% if tsg_runnning_type == 0 %}
+{% if tsg_running_type == 0 %}
 NIC_NAME={{ tsg_tun_mode.ethname }}
 {% else %}
 NIC_NAME={{ nic_mgr.name }}
diff --git a/roles/kernel-ml/tasks/main.yml b/roles/kernel-ml/tasks/main.yml
index c89215b..6eb14f3 100644
--- a/roles/kernel-ml/tasks/main.yml
+++ b/roles/kernel-ml/tasks/main.yml
@@ -17,6 +17,20 @@
   command: /usr/sbin/grub2-set-default 0
   when: t_kernel_ml.changed
 
+- name: "copy /etc/default/grub"
+  copy:
+    src: "{{ role_path }}/files/grub"
+    dest: "/etc/default"
+  when: 
+    - tsg_access_type == 4
+    - t_kernel_ml.changed
+
+- name: "grub2-mkconfig"
+  shell: grub2-mkconfig -o /boot/grub2/grub.cfg
+  when:
+    - tsg_access_type == 4
+    - t_kernel_ml.changed
+
 - name: "reboot"
   reboot:
   when: t_kernel_ml.changed
diff --git a/roles/kni/templates/kni.conf.j2 b/roles/kni/templates/kni.conf.j2
index 0d867c7..a48cfc9 100644
--- a/roles/kni/templates/kni.conf.j2
+++ b/roles/kni/templates/kni.conf.j2
@@ -15,8 +15,12 @@ deploy_mode = normal
 tun_name = tun_kni
 src_mac_addr = 00:0e:c6:d6:72:c1
 dst_mac_addr = fe:65:b7:03:50:bd
-{% if tsg_running_type == 0 %}
-{% else %}
+{% if tsg_access_type == 4 %}
+[tfe0]
+enabled = 1
+dev_eth_symbol = {{ nic_data_incoming.vf1_name }}
+ip_addr = 192.168.100.1
+{% elif tsg_running_type == 1 %}
 [tfe0]
 enabled = 1
 dev_eth_symbol = {{ nic_to_tfe.tfe0.name }}
diff --git a/roles/mrzcpd/templates/mrglobal.conf.ATCA_40G.j2 b/roles/mrzcpd/templates/mrglobal.conf.ATCA_40G.j2
index 3f02cb8..995aead 100644
--- a/roles/mrzcpd/templates/mrglobal.conf.ATCA_40G.j2
+++ b/roles/mrzcpd/templates/mrglobal.conf.ATCA_40G.j2
@@ -1,17 +1,27 @@
 [device]
-device={{nic_data_incoming.name}},vxlan_user,vxlan_fwd
+device={{nic_data_incoming.vf0_name}},{{ nic_data_incoming.vf1_name }},vxlan_user,vxlan_fwd
 sz_tunnel=8192
 sz_buffer=0
 
-[device:{{nic_data_incoming.name}}]
-jumbo_frame=1
-max_rx_pkt_len=4096
+[device:{{nic_data_incoming.vf0_name}}]
+mtu=4096
 clear_tx_flags=1
 vlan-filter=1
 vlan-strip=1
 vlan-id-allow={{ VlanFlipping.vlanID_1 }},{{ VlanFlipping.vlanID_2 }}
 vlan-pvid=0
 vlan-pvid-mode=2
+hw_strip_crc=1
+
+[device:{{ nic_data_incoming.vf1_name }}]
+mtu=4096
+clear_tx_flags=1
+vlan-filter=1
+vlan-strip=1
+vlan-id-allow=4095
+vlan-pvid=0
+vlan-pvid-mode=2
+hw_strip_crc=1
 
 [service]
 # lcore id for i/o service, use comma to split
@@ -37,9 +47,10 @@ sz_cache=256
 sz_data=4096
 
 [forward]
-nr_forward_rule=4
-forward_rule_0=pv,{{nic_data_incoming.name}},{{nic_data_incoming.name}}
-forward_rule_1=vp,{{nic_data_incoming.name}},{{nic_data_incoming.name}}
+nr_forward_rule=6
+forward_rule_0=pv,{{nic_data_incoming.vf0_name}},{{nic_data_incoming.vf0_name}}
+forward_rule_1=vp,{{nic_data_incoming.vf0_name}},{{nic_data_incoming.vf0_name}}
 forward_rule_2=vv,vxlan_fwd,vxlan_user
 forward_rule_3=vv,vxlan_user,vxlan_fwd
-
+forward_rule_4=pv,{{ nic_data_incoming.vf1_name }},{{ nic_data_incoming.vf1_name }}
+forward_rule_5=vp,{{ nic_data_incoming.vf1_name }},{{ nic_data_incoming.vf1_name }}
diff --git a/roles/mrzcpd/templates/mrtunnat.conf.ATCA_40G.j2 b/roles/mrzcpd/templates/mrtunnat.conf.ATCA_40G.j2
index 8513cc7..220eb46 100644
--- a/roles/mrzcpd/templates/mrtunnat.conf.ATCA_40G.j2
+++ b/roles/mrzcpd/templates/mrtunnat.conf.ATCA_40G.j2
@@ -1,14 +1,14 @@
 [tunnat]
 lcore_id={{ mrtunnat.lcore_id }}
 appsym=tunnat
-phydev={{nic_data_incoming.name}}
+phydev={{nic_data_incoming.vf0_name}}
 virtdev=vxlan_fwd
 nr_max_sessions=524280
 nr_slots=1048576
 expire_time=60
 reverse_tunnel=0
 use_recent_tunnel=0
-use_tuple4_as_sskey=1
+use_tuple4_as_sskey=0
 ctrlzone_addr_info_type=2
 
 [vlan_flipping]
diff --git a/roles/telegraf_statistic/tasks/main.yml b/roles/telegraf_statistic/tasks/main.yml
index dd143e2..2f85ff7 100644
--- a/roles/telegraf_statistic/tasks/main.yml
+++ b/roles/telegraf_statistic/tasks/main.yml
@@ -19,7 +19,7 @@
   copy:
     src: "{{ role_path }}/files/telegraf_statistic.service"
     dest: /usr/lib/systemd/system
-    chmod: 0755
+    mode: 0755
 
 - name: "Start telegraf"
   systemd:
diff --git a/roles/tfe/templates/tfe-env-config.j2 b/roles/tfe/templates/tfe-env-config.j2
index 4c163f6..6176eac 100644
--- a/roles/tfe/templates/tfe-env-config.j2
+++ b/roles/tfe/templates/tfe-env-config.j2
@@ -1,10 +1,16 @@
 {% if tsg_running_type == 0 %}
 TFE_DEVICE_DATA_INCOMING=tun_kni
+{% elif tsg_access_type == 4 %}
+TFE_DEVICE_DATA_INCOMING={{ nic_data_incoming.vf2_name }}
 {% else %}
 TFE_DEVICE_DATA_INCOMING={{ nic_data_incoming.name }}
 {% endif %}
 TFE_LOCAL_MAC_DATA_INCOMING=fe:65:b7:03:50:bd
+{% if tsg_access_type == 4 %}
+TFE_PEER_MAC_DATA_INCOMING=00:0e:c6:d6:72:c1
+{% else %}
 TFE_PEER_MAC_DATA_INCOMING=aa:bb:cc:dd:ee:ff
+{% endif %}
 TFE_LOCAL_IP_DATA_INCOMING=172.16.241.2
 TFE_PEER_IP_DATA_INCOMING=172.16.241.1
 
diff --git a/roles/tsg-env-tun-mode/templates/setup.j2 b/roles/tsg-env-tun-mode/templates/setup.j2
index 179a4f5..d0e6b63 100644
--- a/roles/tsg-env-tun-mode/templates/setup.j2
+++ b/roles/tsg-env-tun-mode/templates/setup.j2
@@ -3,9 +3,25 @@ modprobe 8021q
 vconfig add {{ tsg_tun_mode.ethname }} 100
 vconfig set_flag {{ tsg_tun_mode.ethname }}.100 1 1
 ifconfig {{ tsg_tun_mode.ethname }}.100 192.168.100.1 netmask 255.255.255.0 up
+{% if tsg_access_type == 0 %}
 ethtool -K {{ tsg_tun_mode.internal_interface }} tso off
 ethtool -K {{ tsg_tun_mode.internal_interface }} gso off
 ethtool -K {{ tsg_tun_mode.internal_interface }} gro off
 ethtool -K {{ tsg_tun_mode.external_interface }} tso off
 ethtool -K {{ tsg_tun_mode.external_interface }} gso off
 ethtool -K {{ tsg_tun_mode.external_interface }} gro off
+{% elif tsg_access_type == 4 %}
+echo 3 > /sys/class/net/{{ nic_data_incoming.name }}/device/sriov_numvfs
+ip link set {{ nic_data_incoming.name }} vf 1 vlan 4095
+ip link set {{ nic_data_incoming.name }} vf 2 vlan 4095
+ip link set {{ nic_data_incoming.name }} vf 0 trust on
+ip link set {{ nic_data_incoming.name }} vf 1 trust on
+ip link set {{ nic_data_incoming.name }} vf 2 trust on
+ip link set {{ nic_data_incoming.name }} vf 1 mac 00:0e:c6:d6:72:c1
+ip link set {{ nic_data_incoming.name }} vf 2 mac fe:65:b7:03:50:bd
+ip link set {{ nic_data_incoming.name }} vf 0 spoofchk off
+ip link set {{ nic_data_incoming.vf0_name }} up
+ip link set {{ nic_data_incoming.vf1_name }} up
+ip link set {{ nic_data_incoming.vf2_name }} up
+{% endif %}
+
diff --git a/roles/tsg-env-tun-mode/templates/tsg-env_stop.j2 b/roles/tsg-env-tun-mode/templates/tsg-env_stop.j2
index 9976a0a..7393749 100644
--- a/roles/tsg-env-tun-mode/templates/tsg-env_stop.j2
+++ b/roles/tsg-env-tun-mode/templates/tsg-env_stop.j2
@@ -1,5 +1,8 @@
 #!/bin/bash
 #
-echo 0 >/sys/class/net/ens1/device/sriov_numvfs
+echo 0 >/sys/class/net/{{ tsg_tun_mode.ethname }}/device/sriov_numvfs
 ifconfig {{ tsg_tun_mode.ethname }}.100 down
 vconfig rem {{ tsg_tun_mode.ethname }}.100
+{% if tsg_access_type == 4 %}
+echo 0 >/sys/class/net/{{ nic_data_incoming.name }}/device/sriov_numvfs
+{% endif %}