anchor.diff:  
   
   <table border="1" id="when-tls-prune" class="nice">
  -  <tr><th>Gorouter pruning behavior with TLS instance validation</th>
  +  <tr><th>Gorouter pruning behavior with TLS enabled</th>
     	<th>TLS handshake succeeds and app instance matches routing table</th>
     	<th>TLS handshake fails; app instance mismatch</th>
     </tr><tr>
  -  	<td>Time to Live (TTL) Expired</td>
  +  	<th>Time to Live (TTL) has expired</th>
     	<td>Do not prune the route</td>
  -  	<td>Prune the route</td>
  -  </tr><tr>
  -  	<td>TTL Not Expired</td>
  +  	<td>Prune the route and re-try with another instance of the app</td>
  +  </tr><tr>
  +  	<th>TTL has not expired</th>
     	<td>Do not prune the route</td>
  -  	<td>Do not prune the route, but mark container ineligible for requests for next 30 seconds</td>
  +  	<td>Do not prune the route, but mark container ineligible for requests for next 30 seconds and re-try with another instance of the app</td>
     </tr>
   </table>
   
  
positive.code: 
  ### <a id="multiple"></a>Gorouter Behavior with Multiple Runtimes
  
  The Gorouter can [validate app instances over TLS](#app-valid-tls) only with Diego cells that support [app instance identity credentials](../security/networking/tls-info.html#container-creds) and TLS.
  
  If cells do not support TLS validation and routing, the Gorouter falls back to [pruning stale routes](#stale) and sending unsecured traffic to the cells.
  
  PCF operators can configure Linux cells, but not Windows cells, to support TLS validation and routing. With Windows apps, the Gorouter sends unsecured traffic and prunes stale routes.
  
  
negative.code: 
  Upstream, the Gorouter subscribes to the NATS updates to keep its route information current. But network partitions can cause the Gorouter's routing tables to fall out of sync.
  
  You can configure the Gorouter to direct traffic to app instances in two modes, with and without TLS enabled to containers:
  
  <table border="1" id="gorouter-modes" class="nice">
    <tr><th>Gorouter mode:</th>
    	<th>How Gorouter sends traffic to Diego cells:</th>
    	<th>How Gorouter updates its routing table:</th>
    </tr><tr>
    	<td><a href="#with-tls"><strong>With TLS Enabled</strong></a></td>
    	<td>Secured, over TLS</td>
    	<td>Prunes routes with instance identity mismatch; see <a href="#when-tls-prune">Gorouter TLS pruning behavior</a></td>
    </tr><tr>
    	<td><a href="#without-tls"><strong>Without TLS Enabled</strong></a></td>
    	<td>Unsecured</td>
    	<td>Prunes routes that do not update for time-to-live (TTL), which defaults to 120 seconds.</td>
    </tr>
  