It is neither feasible nor efficient to move the filtering to the network perimeter.
Our infrastructure hosts thousands of virtual machines with specific firewall policies applied directly to the VM interfaces: multicast/broadcast control, port 25 blocking, and other per-VM rules. Replicating...