anchor.diff:  
   ### <a id="config-by-instance-group"></a> Consistency Mode Can Differ by Instance Group
   
  -The Gorouter can [validate app instance identity using TLS](#with-tls) only when Diego cells are configured appropriately. Because cells are configured for TLS through the instance group that they belong to, the Gorouter can run in different consistency modes with cells in different instance groups. For example, the Gorouter can communicate over TLS and validate the cells in one Isolation Segment, while communicating with cells in another Isolation Segment via plain text and [without validating instance identity](#without-tls).
  -
  -Currently, only Linux cells support the Gorouter validating app instance identities [using TLS](#with-tls). With Windows cells, the Gorouter runs [without TLS enabled](#without-tls), forwarding requests to Windows apps over plain text and pruning based on route TTL.
  +The Gorouter can validate app instance identity using TLS only when Diego cells are configured appropriately. Because cells are configured for TLS through the instance group that they belong to, the Gorouter can run in different consistency modes with cells in different instance groups. For example, the Gorouter can communicate over TLS and validate the cells in one Isolation Segment, while communicating with cells in another Isolation Segment via plain text and without validating instance identity.
  +
  +Currently, only Linux cells support the Gorouter validating app instance identities using TLS. With Windows cells, the Gorouter runs without TLS enabled, forwarding requests to Windows apps over plain text and pruning based on route TTL.
  +
  +For more information, see [With TLS Enabled](#with-tls) and [Without TLS Enabled](#without-tls).
   
   <% end %>
   
  
positive.code: <%= partial '../console/xfcc_router' %>
  <% end %>
  
  ## <a id="client-side-tls"></a>Client-Side TLS
  
  Depending on your needs, you can configure your deployment to terminate TLS at the Gorouter, at the Gorouter and the load balancer, or at the load balancer only. <%= vars.http_routing %>
  
  
negative.code: 
  ### <a id="without-tls"></a> Without TLS Enabled
  
  In this consistency mode, the Diego Route-Emitters on each cell send route registration messages that include instructions for the Gorouter to send unencrypted requests to the app instance. If the Gorouter does not receive an update for the route within the time-to-live (TTL) interval, the route is pruned from the Gorouter's routing table. For more information, see [TLS to Apps and Other Back End Services](#tls-to-back-end).
  
  This pruning method was developed before the alternative was available.
  
  