Isolation Between Two Layer 2 VLANs

While reviewing the infrastructure technologies that could be on the CCIE Voice lab, I ran across this concept regarding isolation between layer 2 VLANs. What really struck me was the need to emphasize the difference between layer 2 VLANs (ex., via VLAN database) and layer 3 VLANs (ex., interface vlan 1).

A Layer 2 VLAN is the VLAN created in the switch and not configured with the interface vlan <vlan_number> command. Hosts in the different Layer 2 VLANs cannot communicate with each other.

Complete these steps in order to create a Layer 2 VLAN and isolate it from older VLANs:

1. Create the new VLAN in the database. When you exit vlan database mode, the configuration changes are applied.
   
   

   Switch#vlan database
   
   !--- You must enter into VLAN database mode in order to 
   !--- configure any VLAN.
   
   Switch(vlan)#vlan 5
   VLAN 5 added:
       Name: VLAN0005
   Switch(vlan)#vlan 6
   VLAN 6 added:
       Name: VLAN0006
   Switch(vlan)#exit
   APPLY completed.
   Exiting....

2. Make sure the VLAN is created in the vlan database. The new VLAN must appear in the output of the show vlan command.
   
3. Do not set an IP address to the newly created VLANs.
   
4. Configure physical interfaces that connect the clients to the corresponding VLAN.
   
   

   Switch(config)#interface fastEthernet 2/1
   Switch(config-if)#switchport mode access
   Switch(config-if)#switchport access vlan 5
   Switch(config-if)#no shut
   Switch(config)#interface fastEthernet 2/2
   Switch(config-if)#switchport mode access
   Switch(config-if)#switchport access vlan 6
   Switch(config-if)#no shut
   

5. Assign to each host a static IP address, subnet mask, and do not set a default gateway. This causes hosts on the ports fa 2/1 and 2/2 to not communicate with each other. Devices that belong to one VLAN do not reach anything else but devices within the same VLAN.
   

Complete document found here.