Background Theory
In a switched network, VLANs separate devices into different collision domains and Layer 3 (L3) subnets. Devices within a VLAN can communicate with each other without the need for routing. Devices in separate VLANs require a routing device to communicate with one another.
L2-only switches require an L3 routing device. The device is either external to the switch or in another module on the same chassis. A new breed of switches incorporate routing capability within the switch. An example is the 3550. The switch receives a packet, determines that the packet belongs to another VLAN, and sends the packet to the appropriate port on the other VLAN.
A typical network design segments the network based on the group or function to which the device belongs. For example, the engineering VLAN only has devices that relate to the engineering department, and the finance VLAN only has devices that relate to finance. If you enable routing, the devices in each VLAN can talk to one another without the need for all the devices to be in the same broadcast domain. Such a VLAN design also has an additional benefit. The design allows the administrator to restrict communication between VLANs with use of access lists. In the example in this document, you can use access lists to restrict the engineering VLAN from access to devices on the finance VLAN.
This link have a configurations example and nice drawing for better understanding of the theory:
http://www.cisco.com/en/US/tech/tk389/tk815/technologies_configuration_example09186a008015f17a.shtml
