subnetwork connection protection