Hi Jon, you can tag VLANs on the VPX front if you wish. The consideration is more around the internal traffic flow of the NetScaler. Every interface and IP by default sits on the NetScaler default VLAN. Are any of these VLANs secure VLANs? You may want to take a look at traffic domains and policy based routes to control traffic flow.