In order to provide subnet level isolation, you want to force instance-A in one subnet to route through a security appliance, called instance-B, in another subn...