anchor.diff:  The `router_shared` router will register all routes that do not have an `isolation_segment` value.
   The `router_is1` router will only register routes that have an `isolation_segment` value of `is1`.
   
  -##<a id='isolation-segments-metrics'></a>Metrics for Routers Associated with Isolation Segments
  +##<a name='isolation-segments-metrics'></a>Metrics for Routers Associated with Isolation Segments
   
   For metrics emitted by the Gorouter, metrics can be distinguished by the name of the job.
   For example, the following line is a metric emitted on `uptime`:
  
positive.code: 
  The sections below describe a configuration that routes applications from [distinct domain names](#distinct-domain), and a configuration that routes applications from a [shared domain name](#sharing-domain). The diagrams illustrate a topology with separate load balancers, but you could also use one load balancer with multiple interfaces.
  
  ### <a id='distinct-domain'></a>Distinct Domain Names
  
  In a configuration that routes applications from distinct domain names:
  
  
negative.code: 
  <%= image_tag('is-sharing-domains.png') %>
  
  <% if vars.product_name == 'CF' %>
  ##<a name='config-firewall'></a> Step 7: Configure Firewall Rules
  <% else %>
  ##<a name='config-firewall'></a> Step 6: Configure Firewall Rules
  <% end %>
  
  Configure firewall rules to allow necessary traffic between the shared isolation segments (`sample-shared-is`) and the private isolation segments (`sample-is1` and `sample-is2`). Assuming a default deny-all rule, these rules should prevent a request with a spoofed Host header from being forwarded by a router to an application in another isolation segment.
  
  