During the SAN migration we placed an extra dual port NIC in the servers to make a total of eight Gigabit ports per server so we can build a virtual DMZ on two separate ports from the six ports that we use for the Service Console, VMotion and data center traffic.
It’s not essential to bring a DMZ into your VI this way (I guess you could put it on a VLAN and just make a vSwitch that only does that specific VLAN traffic) but it’s just something where we feel more comfortable having this traffic physically separated. A side effect is that it’s easier to explain to someone with less knowledge about virtualization which helps in certain situations (audits for example).
