A device configured to or programmed to instantiate an isolated sub-fabric is presented. A network configuration device uses a virtual air gap policy to instantiate a sub-fabric from a fabric of networking nodes. The sub-fabric is configured with an internal routing policy that respects the nature of the defined isolation. Further, the fabric is provisioned with a virtual air gap that ensures the external networking nodes respect the isolation of the sub fabric.