I had need to tag the service console and vmkernel portgroups well after the fact of building a bunch of ESX server. It’s actually pretty easy to do. Command is: esxcfg-vswitch -p <Portgroup Name> -v <VLAN ID> <vSwitch Name>
`esxcfg-vswitch -p Service Console -v 999 vSwitch0`
From there the easy way of change the VMkernel port is via the GUI.