I have a network architecture that requires a port group on a distributed vSwitch to take a trunk link in and split traffic off to access ports, per vlan. I have a quick sketch of what I am trying to do. I am unclear as to how to do this (or if it is even possible) after reviewing documentation from Vmware and other sources. I don't think private vlans are the answer, and I don't see a way to use Q-in-Q.
Any help or insight is greatly appreciated.
NOTE: Traffic flows north to the internet and south to my private subnets/workstations, if that makes a difference.
NOTE 2: This is all software based. The router is a Cisco VM and the "devices" are individual firewall VMs.