I'm currently running VMWare ESX 4 with several virtual machines. One of these VMs needs to be PCI-DSS compliant, and more may need compliance in the future. In other words, I don't want to allow any LAN-LAN traffic. I currently have a SonicWall TZ100 as the firewall for the box. It seems there is a way to block traffic between VMs on the LAN with the PortShield feature, but I have so far failed to get this configured.
So, either of these approaches will work fine for me:
A. setup security for each VM that needs compliance, so that it denies traffic from anywhere else in the LAN.
B. simply block all intra-LAN traffic (I tried to do this with a simple LAN-LAN access rule but it didn't block anything).