However that said, VLANs even though they are not considered a security mechanism, should be used to seperate your traffic, more importantly is to seperate the traffic flows. make sure that your Service console traffic and any VMKernel traffic are separated from your Production Guest traffic, this can be at the lowest level by portgroups and VLANs (not particularly secure, but better than nothing), moving up to seperate pNIC's and vSwitches and finally a completely seperate set of pSwitches to guarantee independent traffic flow (very secure but also very expensive,

how many pNIC's will you have in your guest. The more the merrier. with as little as 4 pNiICs you can start design with true security in mind,

vmnic0 + vmnic2 --> Service Console and VMKernel traffic

vmnic1 + vmnic3 --> Production Guest traffic.

Have a read of Ed Haletky's (Texiwill) very good series on NIC placement in design found here

Now are you aware that the release of View 4 is just around the corner, (guesstimated release date mid November) this would allow you to introduce all the vSphere goodness and utilise VDI. just a thought

If you found this or any other answer useful please consider the use of the Helpful or correct buttons to award points

Tom Howarth VCP / vExpert
VMware Communities User Moderator
Blog: www.planetvm.net
Contributing author on "VMware vSphere and Virtual Infrastructure Security: Securing ESX and the Virtual Environment".