The simplest way to accomplish this would be to use access control lists on the PC subnets that restrict access to other PC subnets.
For example, if your server subnet is 192.168.1.0/24 (VLAN 1) and your workstation subnets are 192.168.2.0/24 (VLAN2) and 192.168.3.0/24 (VLAN3), you could use the configuration below:
Interface VLAN2
ip address 192.168.2.1 255.255.255.0
ip access-group 102 in
Interface VLAN3
ip address 192.168.3.1 255.255.255.0
ip access-group 103 in
access-list 102 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 102 permit ip 192.168.2.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 103 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 103 permit ip 192.168.3.0 0.0.0.255 192.168.3.0 0.0.0.255
Don't forget that there is an implicit deny ip any any at the end off the ACL so if Internet access is required you will have to change the ACL's to deny access to all other PC VLAN's and then permit any as the last entry.
The ACL's as set above will allow the PC subnets to communicate to the server subnet, but not to the other PC subnet. The second entry in each of the ACL's allows HSRP to communicate between the two layer 3 interfaces of each Cat3550. With no ACL on the server subnet, the servers are allowed to communicate to all the PC subnets.
IPX communication can be restricted in the same manner by using ACL's that list IPX network addresses. This ACL would look something like below where AAAAAAAA is a PC VLAN and BBBBBBBB would be a server VLAN.
access-list 800 permit AAAAAAAA BBBBBBBB
I'm not sure if you would need the IPX ACL though since the server VLAN does not have IPX enabled on it. If this is the case, is there a need for IPX on the PC vlans? If not, you can restrict access over this protocol by removing IPX from the vlan interface.
