anchor.diff:    - az: z1
       cloud_properties:
         security_groups:
  -      - FIGURE-THIS-OUT
  -      subnet: FIGURE-THIS-OUT
  -    gateway: 10.0.16.1
  -    range: 10.0.16.0/20
  -    reserved:
  -    - 10.0.16.2-10.0.16.3
  -    - 10.0.31.255
  +      - SECURITY-GROUP-FROM-AZ1-NETWORK
  +      subnet: SUBNET-FROM-AZ1-NETWORK
  +    gateway: GATEWAY-IP-FROM-AZ1-NETWORK
  +    range: RANGE-FROM-AZ1-NETWORK
  +    reserved: 
  +    - RESERVED-IPS-FROM-AZ1-NETWORK
       static:
  -    - 10.0.31.190-10.0.31.254
  +    - STATIC-IPS-FROM-AZ1-NETWORK
     - az: z2
       cloud_properties:
         security_groups:
  -      - FIGURE-THIS-OUT
  -      subnet: FIGURE-THIS-OUT
  -    gateway: 10.0.32.1
  -    range: 10.0.32.0/20
  +      - SECURITY-GROUP-FROM-AZ2-NETWORK
  +      subnet: SUBNET-FROM-AZ2-NETWORK
  +    gateway: GATEWAY-IP-FROM-AZ2-NETWORK
  +    range: RANGE-FROM-AZ2-NETWORK
       reserved:
  -    - 10.0.32.2-10.0.32.3
  -    - 10.0.47.255
  +    - RESERVED-IPS-FROM-AZ2-NETWORK
       static:
  -    - 10.0.47.190-10.0.47.254
  +    - STATIC-IPS-FROM-AZ2-NETWORK
     - az: z3
       cloud_properties:
         security_groups:
  -      - FIGURE-THIS-OUT
  -      subnet: FIGURE-THIS-OUT
  -    gateway: 10.0.48.1
  -    range: 10.0.48.0/20
  +      - SECURITY-GROUP-FROM-AZ3-NETWORK
  +      subnet: SUBNET-FROM-AZ3-NETWORK
  +    gateway: GATEWAY-IP-FROM-AZ3-NETWORK
  +    range: RANGE-FROM-AZ3-NETWORK
       reserved:
  -    - 10.0.48.2-10.0.48.3
  -    - 10.0.63.255
  +    - RESERVED-IPS-FROM-AZ3-NETWORK
       static:
  -    - 10.0.63.190-10.0.63.254
  +    - STATIC-IPS-FROM-AZ3-NETWORK
     type: manual
   ```
   
  -Here are some important takeaways from this example:
  -
  +Here are some important points about this example:
  +
  +* Unless otherwise noted,
  +  all values come from the Cloud Foundry manifest.
   * You must include compilation configuration.
  -* You must include at least the VM types.
  +* You must include at least the VM types
     and extensions from the example.
   * You must have a network called `default`.
   * You must configure the Availability Zones
     `z1`, `z2`, and `z3`.
  +* This example assumes that your network setup
  +  allows your elbs to talk to your deployment
  +  without additional security groups.
  +  If not, you must add an array of `security_groups`
  +  to the `cf-router-network-properties` and
  +  `diego-ssh-proxy-network-properties`
  +  `vm_extensions`.
   
   Once you've written a suitable cloud config,
   upload it to the BOSH Director:
  
positive.code:   - You must be using an external blobstore.
    - You must either create additional databases
      or disable some optional features in `cf-deployment`.
  
  ## <a id='configure-cli'></a> Step 1: Configure the BOSH CLI v2
  Perform the following steps:
  
negative.code:     ephemeral_disk:
        size: 512000
        type: gp2
  - name: cf-router-network-properties
    cloud_properties:
      elbs:
      - ELB-NAME-FROM-ROUTER-RESOURCE-POOL
  - name: diego-ssh-proxy-network-properties
    cloud_properties:
      elbs:
      - ELB-NAME-FROM-DIEGO-MANIFEST-ACCESS-RESOURCE-POOL
  
  azs:
  - name: z1
    cloud_properties:
      availability_zone: AVAILABILITY-ZONE-FROM-LARGE-Z1-RESOURCE-POOL
  - name: z1
    cloud_properties:
      availability_zone: AVAILABILITY-ZONE-FROM-LARGE-Z2-RESOURCE-POOL
  - name: z3
    cloud_properties:
      availability_zone: AVAILABILITY-ZONE-FROM-LARGE-Z3-RESOURCE-POOL
  
  networks:
  - name: default
  