anchor.diff:    For example:
     <pre class="terminal">$ bosh -e my-env -d cf run-errand nfsbrokerpush</pre>
   
  -Your CF deployment now has a running service broker and volume drivers and is ready to mount NFS volumes.
  -
  -### <a id="broker"></a> Grant Access to the NFS Broker
  -
  -Grant access to the services of the broker by running the following command:
  -
  -<pre class="terminal">$ cf enable-service-access nfs</pre>
  -
  -CF app developers can now create an NFS service and bind instances to their apps.
  +Your Cloud Foundry deployment now has a running service broker and volume drivers 
  +and is ready to mount NFS volumes.
  +
  +### <a id="broker"></a> Grant Access to the NFS Service
  +
  +For Cloud Foundry app developers to use the NFS broker, you must grant app developers access
  +to the NFS service.
  +
  +To grant access to the NFS service, do the following:
  +
  +1. Run the following command:
  +
  +    ```
  +    cf enable-service-access nfs
  +    ```
  +
  +Cloud Foundry app developers can now create an NFS service and bind instances to their apps.
   For more information, see
   [Using an External File System (Volume Services)](../devguide/services/using-vol-services.html).
   
   ### <a id="ldap"></a> (Optional) Enable LDAP Support
   
  -For better NFS security you can configure your deployment to connect to an external LDAP server.
  -Configuring an LDAP server enables the NFS volume driver to do the following:
  -
  -- Ensure that app developers have valid credentials to use an account.
  -- Translate user credentials into a valid UID and GID for that user.
  -
  +For better NFS security, you can configure your Cloud Foundry deployment to connect to an external LDAP server.
   When you connect your deployment to an LDAP server, the NFS volume service is secured
   so that an app developer cannot bind
   to an NFS share using an arbitrary UID.
   This ensures that an app developer cannot gain access to
   sensitive data stored by another user or app.
   
  +Configuring an LDAP server enables the NFS volume driver to do the following:
  +
  +- Validate app developer credentials for user accounts.
  +- Translate user credentials into a valid UID and GID for that user.
  +
   When you enable LDAP support, regular UID and GID parameters are disabled. If you enable LDAP,
   app developers need to provide valid credentials
   for any user they want to use on the NFS server.
   
  -#### Configure your LDAP Server
  -
  -To enable LDAP integration with your CF deployment, your external LDAP server must have the following:
  -
  -- A provisioned service account that has read-only access to user records. This account
  -is used by nfsv3driver to look up usernames and convert them to UIDs.<br>
  -In Windows Server 2008 and later, you can do this by creating a new user
  -  and adding it to the `Read-only Domain Controllers` group.
  -- A LDAP schema that contains `uidNumber` and `gidNumber` fields for the user accounts
  -used by NFS services. These fields are used to establish the correct UID for a named user.
  -- Be reachable through the network from the Diego cell VMs
  -on the port you use to connect to your deployment. This port is usually `389` or `636`.
  -
  -#### Configure your Cloud Foundry Deployment.
  -
  -To enable LDAP authentication in your CF deployment,
  -you must include the `enable-nfs-ldap.yml` ops file in your deployment with the `-o` flag.
  -To view this file,
  +To enable LDAP support, do the following:
  +
  +1. [Configure your LDAP Server](#ldap-config)
  +1. [Configure your Cloud Foundry Deployment](#cf-ldap-config)
  +
  +#### <a name="ldap-config"></a>Configure your LDAP Server
  +
  +If you want to integrate LDAP, your LDAP server must be configured to connect to a Cloud Foundry deployment.
  + 
  +To integrate LDAP with your Cloud Foundry deployment, do the following:
  +
  +1. Configure your external LDAP server to have the following:
  +    - A provisioned service account that has read-only access to user records. This account
  +    is used by nfsv3driver to look up usernames and convert them to UIDs.<br>
  +    In Windows Server 2008 and later, you can do this by creating a new user
  +      and adding it to the `Read-only Domain Controllers` group.
  +    - A LDAP schema that contains `uidNumber` and `gidNumber` fields for the user accounts
  +    used by NFS services. These fields are used to establish the correct UID for a named user.
  +    - Be reachable through the network from the Diego cell VMs
  +    on the port you use to connect to your deployment. This port is usually `389` or `636`.
  +
  +#### <a name="cf-ldap-config"></a>Configure your Cloud Foundry Deployment
  +
  +If you want to integrate LDAP, your Cloud Foundry deployment must redeployed with the `enable-nfs-ldap.yml` ops file
  +and your LDAP server information. 
  +To view the NFS LDAP ops file,
   see [cf-deployment](https://github.com/cloudfoundry/cf-deployment/blob/master/operations/enable-nfs-ldap.yml)
   in GitHub.
  -
  -To use the `enable-nfs-ldap.yml` ops file, you need to provide the following variables
  -in a variables file or with the `-v` flag on the BOSH command line:
  -
  -<table>
  -  <tr>
  -    <th width=35%>Variable</th>
  -    <th>Description</th>
  -  </tr>
  -
  -  <tr>
  -    <td><code>nfs-ldap-service-user</code></td>
  -    <td>This is your LDAP service account user name.</td>
  -  </tr>
  -
  -  <tr>
  -    <td><code>nfs-ldap-service-password</code></td>
  -    <td>This is your LDAP service account password.</td>
  -  </tr>
  -
  -  <tr>
  -    <td><code>nfs-ldap-host</code></td>
  -    <td>This is the LDAP server host name or IP address.</td>
  -  </tr>
  -
  -  <tr>
  -    <td><code>nfs-ldap-port</code></td>
  -    <td>This is the LDAP server port.</td>
  -  </tr>
  -
  -  <tr>
  -    <td><code>nfs-ldap-proto</code></td>
  -    <td>This is the LDAP server protocol. The protocol is either TCP or UDP.</td>
  -  </tr>
  -
  -  <tr>
  -    <td><code>nfs-ldap-fqdn</code></td>
  -    <td>This is the LDAP fully qualified domain name for user records.
  -      This domain name is searched against when user UIDs are looked up.</td>
  -  </tr>
  -
  -</table>
  + 
  +To integrate LDAP with your Cloud Foundry deployment, do the following:
  +
  +1. Provide the following variables in a variables file or with the `-v` flag on the BOSH command line:
  +
  +    <table>
  +      <tr>
  +        <th width=35%>Variable</th>
  +        <th>Description</th>
  +      </tr>
  +
  +      <tr>
  +        <td><code>nfs-ldap-service-user</code></td>
  +        <td>This is your LDAP service account user name.</td>
  +      </tr>
  +
  +      <tr>
  +        <td><code>nfs-ldap-service-password</code></td>
  +        <td>This is your LDAP service account password.</td>
  +      </tr>
  +
  +      <tr>
  +        <td><code>nfs-ldap-host</code></td>
  +        <td>This is the LDAP server host name or IP address.</td>
  +      </tr>
  +
  +      <tr>
  +        <td><code>nfs-ldap-port</code></td>
  +        <td>This is the LDAP server port.</td>
  +      </tr>
  +
  +      <tr>
  +        <td><code>nfs-ldap-proto</code></td>
  +        <td>This is the LDAP server protocol. The protocol is either TCP or UDP.</td>
  +      </tr>
  +
  +      <tr>
  +        <td><code>nfs-ldap-fqdn</code></td>
  +        <td>This is the LDAP fully qualified domain name for user records.
  +          This domain name is searched against when user UIDs are looked up.</td>
  +      </tr>
  +
  +    </table>
  +
  +1. Redeploy your cf-deployment with the `enable-nfs-ldap.yml` ops file by running the following command:
  +
  +    ```
  +    bosh -e MY-ENV -d MY-DEPLOYMENT deploy MANIFEST-YAML -v VARIABLES-YAML \
  +  		-o operations/enable-nfs-ldap.yml
  +    ```
  +
  +    Where:
  +    + `MY-ENV` is the name of the BOSH Director.
  +    + `MY-DEPLOYMENT` is the name of your deployment.
  +    + `MANIFEST-YAML` is the name of the manifest YAML file you used when you deployed Cloud Foundry.
  +    + `VARIABLES-YAML` is the name of the variables YAML file for the LDAP information.
  +
  +    For example:
  +    <pre class="terminal">$ bosh -e my-env -d cf deploy cf.yml -v ldap-vars.yml \
  +		-o operations/enable-nfs-ldap.yml</pre>
  +
   
   ### <a id="server"></a> (Optional) Deploy Test Servers
   
  
positive.code:     Where:
      + `MY-ENV` is the name of the BOSH Director.
      + `MY-DEPLOYMENT` is the name of your deployment.
      + `MANIFEST-YAML` is the name of the manifest YAML file you used when you deployed CF.
      + `VARIABLES-YAML` is the name of the variables YAML file you used when you deployed CF.
  
      For example:
      <pre class="terminal">$ bosh -e my-env -d cf deploy cf.yml -v deployment-vars.yml \
  
negative.code:   For example:
    <pre class="terminal">$ bosh -e my-env -d cf run-errand smbbrokerpush</pre>
  
  Your Cloud Foundry deployment now has a running service broker and volume drivers and
  is ready to mount existing SMB shares.
  
  ### <a id="smb-broker"></a> Grant Access to the SMB Service
  
  For Cloud Foundry app developers to use the SMB broker, you must grant app developers access
  to the SMB service.
  
  To grant access to the SMB service, do the following:
  
  1. Run the following command:
  
      ```
      cf enable-service-access smb
      ```
  
  Cloud Foundry app developers can now create an SMB service and bind instances to their apps.
  For more information, see
  [Using an External File System (Volume Services)](../devguide/services/using-vol-services.html).
  
  ### <a id="smb-server"></a> (Optional) Deploy the SMB Test Server
  
  If you want to experiment with volume mounts, you can deploy a SMB test server using the `enable-smb-test-server.yml` ops file. This file creates a separate VM with SMB shares. To view the SMB test server ops file, 
  see [cf-deployment](https://github.com/cloudfoundry/cf-deployment/blob/master/operations/test/enable-smb-test-server.yml)
  in GitHub.
  
  To redeploy your Cloud Foundry deployment with a SMB test server, do the following:
  
  1. Run the following command:
  
      ```
      bosh -e MY-ENV -d MY-DEPLOYMENT deploy MANIFEST-YAML \
        -o operations/test/enable-smb-test-server.yml
      ```
  
      Where:
      + `MY-ENV` is the name of the BOSH Director.
      + `MY-DEPLOYMENT` is the name of your deployment.
      + `MANIFEST-YAML` is the name of the manifest YAML file you used when you deployed Cloud Foundry.
  
      For example:
      <pre class="terminal">$ bosh -e my-env -d cf deploy cf.yml \
  		-o operations/test/enable-smb-test-server.yml</pre>
  
      <p class="note"><strong>Note:</strong> By default, the SMB test server expects that your
        Cloud Foundry deployment is deployed to a <code>10.x.x.x </code>subnet.
        If you are deploying to a subnet that is not <code>10.x.x.x</code>,
        you must override the <code>export_cidr</code> property.<br><br>
       To override the <code>export_cidr</code> property, edit the ops file and
       add in the properties section <code>export_cidr: YOUR-SUBNET</code>,
       where <code> YOUR-SUBNET</code> is the subnet you are deploying Cloud Foundry to.
      </p>
  