In a mixed network of Dell and HP/Aruba devices, we would like to block all communication between client computers, and only allow them to communicate with servers located on a different VLAN*.
There are two core switches, Dell S4048-ON (bundled OS), with servers attached, and other "edge" switches connected to the clients. One pair of edge switches are connected with a loop configuration, for high availability (unrelated to this).
I have solved it inside any of the "edge" switches, which are HP 2920 and 2810:
filter source-port named-filter "uplink-only" drop 1-44 filter source-port 1-44 named-filter "uplink-only"
However, the client VLAN (VLAN 3) is available on the uplink to the core routers. So the intra-VLAN packets will appear on the other edge switches.
The core switches are currently configured without ACL, simply routing between VLAN 1 and 3.
The question is then how to implement an ACL for the Core switches to prevent forwarding packets within VLAN 3 -- but allow routed traffic from that VLAN. For redundancy purposes, it is necessary to forward VLAN1 between ports as is done now, allowing a link do go down in the redundantly configured swithces. Also, DHCP must be available to the clients, from another server on VLAN 1, using the "ip helper-address" option.
Alternative solutions to the general problem of blocking traffic between clients are of course welcome.
*The reason is to improve security when the client devices may not always be configured securely.