where a network is logically separated by a subnet, firewall, VLAN, etc.