L2 port security

private vlans offer the ability to provide another layer of access control, such as in a DMZ environment, where all the web servers might be in same vlan, but you don't want them to be able to talk to each other. The LTM doesn't have this capability. That said, you could build packet filters to disallow traffic at l3/l4 level between hosts on a vlan if all their traffic flows through the LTM (ie, they're both directly connected to the switch plane). If they aren't directly connected, intra-vlan traffic won't flow to the LTM anyway. I've always used access switches for this kind of control, where there are quite a few more l2 tricks availalble.