Here is the scoop on the 1000v & vShield Zones. Today, Zones are implement by placing a virtual appliance between two vSwitches - one with guests, one with the physical NICs. This deployment happens automatically on the ESX hosts you choose. Works great w/ the distributed vSwitch and the original vSwitch. However, Cisco 1000v does not allow for multiple instances of a switch to do this inline deployment to create a similar deployment as w/ VMware vSwitches; something that we're been working with Cisco with even before vSphere 4.0 was released. This affects any non-VMsafe virtual network appliance out there that need to go inline, so it's something that Cisco plans to address. The solutions we've discussed with Cisco are along the lines of what physical network appliances do, where there is a few lines of CLI configs on the Cisco to do send traffic to a virtual appliance for monitoring via dot1q trunk or untagged interface using policy-based routing or vACLs.
Today, it's possible to use vShield Zones with 1000v by actually creating a vDS or a regular vSwitch that homes all of the physical NICs and the 1000v continues to manage all the guests with the vShield sitting between the two inline. This works well, however, you do loose some of the features Cisco offers on the uplink side. If anyone is interested in trying out this configuration and other details, feel free to contact me <sergey@vmware.com>.
