Thanks for the input guys and I'll take a look at that link.
The converter is installed on the VCenter server, but currently only has one network interface configured on it. If we setup another network card on that VM and attached it to the management network, would that remove the need for the conversion traffic to go through the firewall? Or does it not actually go through the machine the converter is installed on and instead goes directly from the physical machine to the ESXi cluster using the management network?