anchor.diff:  
   ## <a name='create-networks'></a> Step 1: Create Networks
   
  -Create a network or subnet for each isolation segment on your infrastructure. For example, an operator who wants one isolation segment separated from their <%= vars. app_runtime_abbr %> Diego Cells could create one network named `sample-network` with two subnets named `sample-subnet-<%= vars. app_runtime_abbr_lc %>` and `sample-subnet-is1`.
  -
  -The following diagram describes the network topology:
  +Create a network or subnet for each isolation segment on your infrastructure. For example, an operator who wants one isolation segment separated from their <%= vars.app_runtime_abbr %> Diego Cells could create one network named `sample-network` with two subnets named `sample-subnet-<%= vars.app_runtime_abbr_lc %>` and `sample-subnet-is1`.
  +
  +The diagram below describes the network topology:
   
   ```
   IaaS network: sample-network
     |
  -  |_____ IaaS subnet: sample-subnet-<%= vars. app_runtime_abbr_lc %>
  +  |_____ IaaS subnet: sample-subnet-<%= vars.app_runtime_abbr_lc %>
     |
     |_____ IaaS subnet: sample-subnet-is1
   ```
  
positive.code: 
  The diagrams illustrate a topology with separate load balancers, but you could also use one load balancer with multiple interfaces. In this configuration:
  
  * Requests for system domain `*.cf-system.com` and the shared domain `*.shared-apps.com` are forwarded to the Gorouters for the <%= vars. app_runtime_abbr %> Diego Cells.
  
  * Requests for private domain `*.foo.private-domain.com` are forwarded to the Gorouters for IS1. Requests for private domain `*.private-domain.com` are forwarded to the Gorouters for IS2.
  
  
negative.code: 
  Isolation segments isolate the compute resources for one group of apps from another. However, these apps still share the same network resources. Requests for apps on all isolation segments, as well as for system components, transit the same load balancers and <%= vars.app_runtime_abbr %> Gorouters.
  
  When you use isolation segments, <%= vars.app_runtime_abbr %> designates its Diego Cells as belonging to an isolation segment called `shared`. This isolation segment is the default isolation segment assigned to every org and space. This can be overwritten by assigning an explicit default for an organization. <%= vars.install_isolation_segments %>
  
  The illustration below shows isolation segments sharing the same network resources.
  
  