This image shows three subnets, labeled Subnet B, Subnet A, and Access Subnet. Subnet B and Subnet A each contain an instance; Access Subnet contains a network firewall (NFW). The numbers 1 and 2 are external to Access Subnet but label arrows that point to the NFW. The arrow from the instance in Subnet B is labeled 5. Two arrows emerge from Subnet A, one of which is labeled 3. These arrows and one from the NFW enter a fourth subnet, labeled Protected Subnet,through a Security List. Inside the Protected Subnet, each arrow enters a separate instance, through a network security group (NSG). One line is labeled 5. Data flow and the meaning of the number labels is described in the surrounding text.