How to deny the same network L2 layer?

[JustTakeTheFirstStep]

We want to isolate PC1 and PC2.
PC1 and PC2 are not subject to the ACL because they are in the same network.
Is a Private vlan appropriate?
Any ideas?

[MHM Cisco World]

VACL is filter inter and intra VLAN traffic. 
he need to make host reach the GW to connect to other subnet 

MHM

[paul driver]

Hello @MHM Cisco World 

VACL is filter inter and intra VLAN traffic. 
he need to make host reach the GW to connect to other subnet 

MHM

---

Inter-vlan traffic will still work

[Flavio Miranda]

@JustTakeTheFirstStep 

Private vlan or Mac access list

[paul driver]

Hello 
VACLS/PVLANs are both ways of negating connectivity between multiple host within the same vlan however for just a single PC-PC
you can use a protected port

PC1 & PC2
int x/x
switchport protected 

[JustTakeTheFirstStep]

@paul driver 

https://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3.2_0_se/multibook/configuration_guide/b_consolidated_config_guide_3850_chapter_011101.html

[paul driver]

Hello
Yeah apologies..I realised after i posted your OP has switch interconnects, it does only work hosts on the same switch its a little one to beware of in case such a need cases arises ( depending that if the switch ios supports it, as its a rather old feature) 

[paul driver]

Hello

FYI- by default there is a deny stanza in vacls so all you need in this instance to append a manual drop action and permit everything else

Try the following:

access-list 100 permit ip 144.144.144.0 0.0.0.255 144.144.144.0 0.0.0.255

vlan access-map VACL 
match ip address 100
action drop

vlan access-map VACL 100
action forward

vlan filter VACL vlan-list 144

[JustTakeTheFirstStep]

@paul driver 

But the gateway is still denied.
Test was successful as per MHM's answer
Thank you very much for your continued interest.

[paul driver]

Hello
you do not need to reach the gateway it will still work (intervlan routing ) that is for the filtered vlan 144