anchor.diff:  <tr>
   <td><code>udp</code></td>
   <td><code>8301</code></td>
  +<td>Consul**</td>
  +<td></td>
  +</tr>
  +<tr>
  +<td><code>udp</code></td>
  +<td><code>8302</code></td>
  +<td>Consul**</td>
  +<td></td>
  +</tr>
  +<tr>
  +<td><code>udp</code></td>
  +<td><code>8600</code></td>
   <td>Consul**</td>
   <td></td>
   </tr>
  
positive.code:       - <strong>sample-shared-is</strong>
        # with bbl, there will also be a cf internal security group
        subnet: <strong>sample-subnet-shared-az1</strong>
      - range: 10.1.16.0/20
        gateway: 10.1.16.1
        reserved:
        - 10.1.16.2-10.1.16.3
        - 10.1.31.255
        static:
        - 10.1.31.190-10.1.31.254
        <strong>az: z2</strong>
        cloud_properties:
          security_groups:
          - <strong>sample-shared-is</strong>
          # with bbl, there will also be a cf internal security group
          subnet: <strong>sample-subnet-shared-az2</strong>
      - range: 10.0.200.0/28
        gateway: 10.0.200.1
        reserved:
        - 10.0.200.2-10.0.200.3
        - 10.0.200.15
        static:
        - 10.0.200.11-10.0.200.15
        <strong>az: z3</strong>
        cloud_properties:
          security_groups:
          - <strong>sample-is1</strong>
          subnet: <strong>sample-subnet-is1-az1</strong>
      - range: 10.1.200.0/28
        gateway: 10.1.200.1
        reserved:
        - 10.1.200.2-10.1.200.3
        - 10.1.200.15
        static:
        - 10.1.200.11-10.1.200.15
        <strong>az: z4</strong>
        cloud_properties:
          security_groups:
          - <strong>sample-is1</strong>
          subnet: <strong>sample-subnet-is1-az2</strong>
  </code>
  </pre>
  
  
negative.code: 
  <%= image_tag('routing-is.png') %>
  
  Operators who want to prevent all isolation segments and system components from using the same network resources can deploy an additional set of routers for each isolation segment:
  
  <%= image_tag('is-distinct-domains.png') %>
  
  Use cases include:
  
  * Requests for applications in an isolation segment must not share networking resources with requests for other applications.
  * The Cloud Foundry management plane should only be accessible from a private network. As multiple IaaS load balancers cannot typically share the same pool of backends, such as Cloud Foundry routers, each load balancer requires an additional deployment of routers.
  