I admittitly haven't tried ESX (yet), I've only messed around with the free server version. I'm also not a networking person, I'm more of a server guy.
However I'm pretty confused by these answers. If I have physical NIC on the host devoted to the DMZ, I know I can go into the guests and allow/disallow them access to the various physical NICs. That keeps the other guests out of the DMZ. But how does that keep the host out of the DMZ? It would see the phyiscal NIC, know about that IP address, etc, etc. Clarification please! 
Or a link explaining how this works would be just as good.
With VMware Server you have a host operating system like windows or linux which shares its resources (memory/disk/cpu) with any of the virtual machines running on top of a virtualization layer. The isolation between host and VM is pretty good, but there are a few escape vectors. Like the current one about using directory traversal techniques on a shared folder. (disable shared folders to eliminate the possibility)
The host OS controls the shared NIC as you would expect.
Now with ESX, the host operating system is also responsible for the virtualization layer. As you can imagine this means much better control for virtualization.
The NIC virtual hardware is only directly accessible by the vmkernel, so there is no direct access possible outside of your VM.
In the case where your VM is successfully hacked, it still doesn't give the hacker access to the host as there are NO known escape vectors where you break out of the VM in order to control the host. So while ESX still manages your virtual hardware, it only manages it as virtualizing the NIC, not by using it.
On a hosted product (like VMware Server or MS Virtual Server/Hyper V) your VM can only employ devices already used by the host OS.
This also explains why you should never expose your management network (that has the service console on it for example) to your VMs. Certainly not to VMs in the DMZ.
--
Wil
