You can use PVLANs to utilize primary vlans and map sub/stub or secondary vlans to that primary. This provides security between the isolated host residing on these secondary vlan ports. Keep in mind that all host that reside on the isolated/secondary vlans must communicate via the routed/virtual routed interface...even for communication that reside on the same vlan/sw. This configuration can span multiple switches as well via trunk ports. Depending on your setup you have a few options for port configurations. Promiscous, isolated and community. Community ports comm. between each other. Isolated ports only can ccomm. w/ promiscuous ports and Promiscous ports can comm with any type within their primary vlan domain. Hopefully this helps with your questions. We do this for host on our network for security reasons. We use the acl at the router to restrict communications to any other resources on the network, regardless of vlan or subnet.