John,
I'm not sure what version of VMware you are using, but I know in ESX/ESXi 4.1 the default is to use SSL for this port 902 communication (it's VNC + SSL).
So, this is why the default policy for WAAS is TFO only, and modifying the policy would not be recommended unless you removed this SSL configuration from the VMware side. Since, you can not find redundant bit patterns (DRE) in SSL encrypted traffic, and you will not see much benefit from LZ compression either. Thus, the best you could get is TFO only with this configuration on the VMware side.
In my lab I modified the VMware ESXi Host configuration to disable the SSL requirement via the Configuration tab -> Advanced Settings -> Config -> Defaults -> security -> host -> uncheck "require SSL"
Then I modified the policy "Vmware-VMConsole" on the WAAS CM AllDevicesGroup to be Full Optimization (TFO, DRE, LZ). When I made a new connection to launch the VM Console of a VM on the host I made the above modification I saw a reduction ratio of about 40 - 50%.
Hope this helps,
Mike Korenbaum
Cisco WAAS PDI Help Desk