i am looking still for that feature on s-series ... any advices ?
All Edge ports on EOS (D- and B-Series) and EXOS Switches are working with protected ports. All Edge Switches are linked with S-Series which is the L3- / Inter-VLAN Router and the Central point for Servers. So client are only alloweded to communicate with Router IP or central Servers - not with other Clients (not on same not on other edge switches).
Talking with two of extreme pre-sales guys bring a good solution:
s-series L2 ACL (starting with V8.42)!
with a few lines i can allow communication to MAC of L3 Router, ARP, needed Broadcast traffic only and deny all other Client to Client traffic.
Logging function is very helpful to see if ruleset is complete.
In EXOS there is a feature "port isolation" which does the trick.
You can configure it on the port with an UPM that is triggered from the security profile, which comes along with the vlan assignment via Radius.