Cisco switches support a security feature known as Private VLANs (PVLANs), with one port used to uplink to a router or firewall port, and the remaining ports configured as completely private? I'm not sure how Cisco defines PVLAN, but the key attribute I must have for this product is that all data must pass from a private port to the uplink port, with no possibility for broadcast, arp, or layer 3 traffic to travel between private ports. This must be true even if the host attached to a private VLAN port can impersonate a different MAC address other than its own, and must be true even if the host knows the target MAC address of a host on a different VLAN port.
Since I will be using one of these switches for each segment attached to a firewall, and the number of hosts are trivially small, I have no concerns about density or about passing VLAN information across multiple switches.
What are my product options? I would like to identify both a fast ethernet and a gigabit switch.