We're currently using port isolation to prevent communication between computers on the same vlan and use client isolation on our guest wifi. The reason for having this enabled is to prevent unwanted programs to spread itself between computers or to prevent potential attackers from attacking victims with a bad configured firewall on the guest network. This is working absolutely flawlessly with IPv4.
Now we would like to deploy IPv6 in our network. Especially SLAAC with Privacy Extension enabled heavily relies on reaching other clients on the network to do e.g. Duplicate Address Detection. When enabling port isolation this feature will not work anymore.
We're having no idea how to solve this issue with some "normal" switching hardware, so any idea would be helpful. The other way of solving this would be to simply ignore Duplicate Address Detection and hope that the propability is low enough to not have any collisions, but will port isolation break some other fundamental IPv6 features?
Some idea we had: We could create up to 4096 vlans and apply each vlan to a single port. The router would also have 4096 interfaces and each will send different prefixes using Router Advertisements to the client, but I think that this won't scale very well :). It's kind of what ISPs do with PPPoE tunnels, but in ugly.