anchor.diff:  
   This topic describes how operators can configure and manage routing for isolation segments. Operators can deploy an additional set of routers for each isolation segment to handle requests for applications within the segment. This topic includes the following sections:
   
  -<% if vars.product_name == 'CF' %>
   * <a href="#overview">Overview</a></td>
   * <a href="#create-networks">Step 1: Create Networks</a></td>e
   * <a href="#config-networks">Step 2: Configure Networks for Routers</a></td>
  
positive.code: The `router_is1` router will only register routes that have an `isolation_segment` value of `is1`.
  
  <% else %>
  <% end %>
  
  ##<a name='isolation-segments-metrics'></a>Metrics for Routers Associated with Isolation Segments
  
negative.code: * "Backend Services" in the GCP [documentation](https://cloud.google.com/compute/docs/load-balancing/http/backend-service)
  * BOSH Google Compute Engine CPI GitHub [repo](https://github.com/cloudfoundry-incubator/bosh-google-cpi-release/tree/master/src/bosh-google-cpi)
  
  ## <a name='sharding-routers-isolation-segment'></a> Sharding Routers for Isolation Segments
  
  <% if vars.product_name == 'CF' %>
  To provide security guarantees in addition to the firewall rules described above, an operator can configure sharding of Gorouter's routing table, resulting in a router dedicated for an isolation segment having knowledge only of routes for applications in the same isolation segment. The flexibility of the configuration also supports deployment of a router that is responsible for multiple isolation segments, or that excludes all isolation segments.
  
  ### Bypass Cloud Controller Bridge
  
  Support for router sharding depends on bypassing the [Cloud Controller Bridge](../concepts/diego/diego-architecture.html#bridge-components) (CC Bridge). To do so, set the `cc.diego.temporary_local_apps` flag to `true` in your Cloud Config file. This enables the Cloud Controller to send app creation requests containing routing isolation segment information directly to the Diego BBS, rather than through the CC Bridge. 
  