Thanks, I will review the documents and/or maybe hire a network consultant for a couple hours.  I actually do understand what you are suggesting and the concept, but I'm not exactly sure how to configure "ordinary 802.1q VLAN tagging for the separate vMotion and management network" on the physical switch side.  As you can see I usually just create a VLAN on the physical switch containing specific physical ports and never tag on the vSwitch side, but I'm sure it's fairly simple.

I'm also not sure how I would configure the additional interface on the firewall to allow access to the management network VLAN (i.e. vCenter to Hosts) using the 802.1q technique, but probably outside the scope of this thread.  I assume it would have to be tagged as well somehow.

One final clarification if you don't mind.  In your scenario, would the managment and vMotion IP's be on different IP subnets?

Thank you kindly for your time.