Imagine you need several Virtual Machine onto your ESX server. The VMs are composed of two distinct group and those group can only communicate to each others over a physical firewall.
Now, what make sense from an network isolation standpoint? Are all the Virtual Machines running in the same virtual ethernet engine and simply separated using VLANs tagging behind the scene or is it something else like using different memory space with a virtual ethernet engine for each vSwitch? I could not find any information regarding the actual strength of vSwitch isolation except a sale pitch from Cisco stating only Nexus 1000v were doing real separation.
I would like to known your thoughts around the security of virtual switch isolation and VLAN tagging in those kind of environment.
Bottom line, it should really change the way we build LAN connection with Virtual Machines. If it's comparable to physical separation this diagram is quite logical:
Otherwise, if it's using VLAN tagging we need to be consequent and use VLAN tagging on the physical switch (which would not lower the security of this solution).
Keep in mind I did not represent the redundancy layer into those diagrams.