Ability to set up a physical or logical sub-networks that separates an internal local area network (LAN) from other untrusted networks.