I have a question regarding DMZ design in our DC. Let me give you some background.

We have

1 rack 2 Spines 2 leafs L3 TOR connected to each spine ESXI hosts connected to the leafs 1 Palo ALto Active/Standby connected to the Spines

I want to have my DMZ network and internal VM network shared on the existing ESXI hosts.

So the problem im trying to overcome is at my TOR i will have defined SVI,s for

1 Management 2 Vmotion 3 Storage 4 VXLAN 5 VM 6 DMZ

How do i logically separate my DMZ VLAN and VM VLAN from communicating with each other if i have L3 TOR (SVI Configured) and ultimately get my VM traffic to route to the F/W for routing back to the DMZ on the same host

Some of my thoughts are to have a separate VRF?? or extend L2 Vlan from F/W down to Leaf switches

Thx