Distinguish an inside from an outside and regulate every crossing between the two. The system boundary is a network boundary, and network addresses and protocol types are what tell actors and actions apart.

"Perimeter" means circumference or border. A perimeter fence is the fence around a site, and a security perimeter is a security zone. The term moved into cyber security, where its first use was access control via the network.

The guiding thought is "only allow secure networks": inside is assumed good, outside bad, and firewalls and similar devices act as border control at the crossing points. Who you are and what you may do is decided by where your traffic comes from (source address) and what kind of traffic it is (protocol and port). Everything else about this model, both its strength and its weaknesses, follows from that one decision.

In principle a perimeter is possible on every OSI layer, but in practice it is almost always isolation on Layer 2 plus restriction on Layer 3. Physical L2 separation uses different switches and can only be broken physically; virtual separation (VLANs) can be broken by configuration.

The trade-off is the same as with isolation in general: the virtual variant is cheaper and more flexible, but the boundary is now a setting rather than a missing cable, so anyone who can change the setting can remove the boundary.