anchor.diff:  <%= partial '../console/router_app_tls_pcf' %> 
   <% end %>
   
  -### <a id="stale"></a>Prune Stale Routes
  +### <a id="without-tls"></a>Without TLS Enabled
   
   In this mode, the Gorouter's routing table lists a name, address, and port for each app instance, but it does not include GUIDs for the app instances.
   
  
positive.code: 
  
  <table border="1" id="when-tls-prune" class="nice">
    <tr><th>Gorouter pruning behavior with TLS instance validation</th>
    	<th>TLS handshake succeeds and app instance matches routing table</th>
    	<th>TLS handshake fails; app instance mismatch</th>
    </tr><tr>
    	<td>Time to Live (TTL) Expired</td>
    	<td>Do not prune the route</td>
    	<td>Prune the route</td>
    </tr><tr>
    	<td>TTL Not Expired</td>
    	<td>Do not prune the route</td>
    	<td>Do not prune the route, but mark container ineligible for requests for next 30 seconds</td>
    </tr>
  </table>
  
  
negative.code: 
  ### <a id="multiple"></a>Gorouter Behavior with Multiple Runtimes
  
  The Gorouter can [validate app instances over TLS](#with-tls) only with Diego cells that support [app instance identity credentials](../security/networking/tls-info.html#container-creds) and TLS.
  
  If cells do not support TLS validation and routing, the Gorouter falls back to its [without TLS mode](#without-tls) pruning routes based on TTL and sending unsecured traffic to the cells.
  
  PCF operators can configure Linux cells, but not Windows cells, to support TLS validation and routing. With Windows apps, the Gorouter sends unsecured traffic and prunes stale routes.
  
  