anchor.diff:  
   <strong><%= modified_date %></strong>
   
  -This topic describes how to configure your Cloud Foundry deployment to allow SSH access to application instances, and details about load balancing SSH sessions.
  +This topic describes how to configure your Cloud Foundry deployment to allow SSH access to application instances, and includes details about load balancing SSH sessions.
   
   ## <a id='architecture-configuration'></a> Cloud Foundry Configuration
   
  
positive.code: 
  ### <a id='diego-configuration'></a> Diego Architecture
  
  To enable SSH access to apps running on Diego, configure the BOSH and UAA properties in your deployment manifests as follows.
  
  #### <a id='bosh-configuration'></a> Diego Properties
  
  Configure the following properties in your manifest for Diego, `diego.yml`.
  
  1. `diego.ssh_proxy.host_key`: Generate a unique key pair and supply the PEM-encoded RSA private host key for this value. This secures the Application SSH proxy running in the instance container.
  
  1. `diego.ssh_proxy.enable_cf_auth`: Set this property to `true` to activate the CF Authenticator in the proxies. This enables the `cf ssh` command to connect with the SSH proxy.
  
  1. `diego.ssh_proxy.enable_diego_auth`: Set this property to `false` to disable the Diego Authenticator in the proxies, preventing SSH access through Diego API calls.
  <p class='note'><strong>Note:</strong> Developers running development deployments can enable this property to support API calls, as an alternate mechanism to establish SSH sessions.</p>
  
  1. `diego.ssh_proxy.cc.internal_service_hostname` and `diego.ssh_proxy.cc.external_port`: If you use `generate_deployment_manifest` or another spiff-based manifest-generation script, you do not need to configure these properties.
  
  #### <a id='uaa-configuration'></a> UAA Properties
  
  Configure properties in your Cloud Foundry manifest, `cf-deployment.yml`, as follows.
  
  1. Create a stub YAML file `uaa.yml` based on the template below:
  <pre><code>
  properties:
    <<: (( merge ))
    app_ssh:
      host_key_fingerprint: HOST-KEY-FINGERPRINT
      oauth_client_id: ssh-proxy
  
negative.code:         secret: SSH-PROXY-SECRET
  </code></pre>
  
  1. Change `HOST-KEY-FINGERPRINT` to the public key fingerprint of the RSA key pair that you generated for your deployment.
  
  1. For `SSH-PROXY-SECRET`, provide the `Client secret` for the `ssh-proxy` client registered with your UAA server. This should match the `SSH-PROXY-SECRET` you entered in the Diego manifest under `uaa_secret`.
  
  ### <a id="dea-architecture"></a> DEA Architecture
  
  For Cloud Foundry app instances running on DEAs you can configure SSH access with these BOSH properties.
  
  