Hi list-- This is a fairly straightforward question, probably with a quite easy answer. But it's something I've not done before and I just want to bounce it off some others before I bank on it. I'm using ISA 2004 Standard, will probably move to ISA 2006 Standard in the next month or two. Currently I have one subnet in this building (172.17.200.0), and multiple subnets outside the building that are connected to the 172.17.200.0 subnet via VPN. The remote subnets all communicate with the 172.17.200.0 subnet, no problem. In the near future I want to add a couple of new internal subnets using VLANs. (I've never done anything with VLANs before.) These new internal VLAN subnets will go through my ISA server for Internet access, but I DO NOT want them to communicate with my 172.17.200.0 subnet, nor with any of my other current subnets. This is easily done, right? Thanks, Rob -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Rob Moore Network Manager 215-241-7870 Help Desk: 800-500-AFSC