I've been thinking about this one for a while as I have both a hosting
service & do PCI work on an almost daily basis.

What I have come to conclude is that you will most likely want to put
your firewall devices (virtual or otherwise) on different physical
hardware from the other application serv...

[ more ]