A common solution is to set the server switch ports to "protected" and the array ports set to "unprotected".   Protected port device can't talk to other protected devices, only to 'unprotected' ports.   So gateway, arrays, etc would all be 'unprotected'.   Not sure of the Juniper term for protected ports.  VLANs wouldn't work well since you'd have to enable routing between them to get the array to function properly. 
Hello, We have a mix of servers attached to our EQL powered SAN.  Some are mission critical servers with hardly any or 1 administrator's account, some are publicly accessible multi-user systems with thousands of accounts, some are under the administration of business folks who hardly know what they are doing but we cannot remove their privileges, etc. There is usually a front-end firewall that isolates these hosts from each other, but we had a 'duh' moment realizing they are all connected by the physically separate iscsi network. Some ideas we've bounced on how to protect the hosts from each other were switch features (for example, Juniper Private VLANs), and host firewalls (which obviously would be at risk of being shut down by privileged users), unbinding all services from the iscsi NICs. Are there any typically-used techniques that we didn't think of?  Or should we use all of them? Thanks,Ev
iscsi network host isolation