anchor.diff:  ns4-**.azure-dns.info.
   ```
   
  -From your domain registrar, delegate DNS authority for your hosted zone to the
  -four Azure name servers. To do this, change the default nameservers provided by your domain registrar to Azure name servers listed in Azure DNS Zone.
  -
  -After a few minutes, your system domain should resolve to your Azure application gateway.
  +From your domain registrar, delegate DNS authority for your hosted zone to the four Azure name servers. To do this, change the default nameservers provided by your domain registrar to Azure name servers listed in Azure DNS Zone.
  +
  +After a few minutes, your system domain should resolve to your Azure app gateway.
  +
   
   ## <a id="connect-bosh-director"></a> Step 5: Connect to the BOSH Director
   
  -Run the following to connect to the BOSH Director:
  -
  -<pre class="terminal">
  -$ eval "$(bbl print-env)"
  -</pre>
  -
  -## <a id="destroy-environment"></a> Destroy the BOSH Resources ##
  -
  -You can use <code>bbl destroy</code> to delete the BOSH Director infrastructure in your Azure environment.
  -Use this command if `bbl up` does not complete successfully and you want to reset your environment, or if you want to destroy the resources created by bosh-bootloader for any other reason.
  -
  -* Run the following commands to delete only the load balancers:
  -    <pre class="terminal">
  -    $ bbl plan
  -    $ bbl up
  -    </pre>
  -
  -* Run the following commands to delete the infrastructure, BOSH Director, and load balancers:
  -    <pre class="terminal">
  -    $ bbl destroy
  -    </pre>
  +To connect to the BOSH Director:
  +
  +1. Run:
  +
  +    ```
  +    eval "$(bbl print-env)"
  +    ```
  +
  +
  +## <a id="destroy-environment"></a> Destroy the BOSH Resources
  +
  +You can run `bbl destroy` to delete the BOSH Director infrastructure in your Azure environment. Use this command if `bbl up` does not complete successfully and you want to reset your environment, or if you want to destroy the resources created by bosh-bootloader for any other reason.
  +
  +* To delete only the load balancers, run:
  +    
  +    ```
  +    bbl plan
  +    bbl up
  +    ```
  +
  +* To delete the infrastructure, BOSH Director, and load balancers, run:
  +    
  +    ```
  +    bbl destroy
  +    ```
  
positive.code:       --lb-cert YOUR-CERTIFICATE.crt \
        --lb-key YOUR-KEY.key \
        --lb-domain YOUR-SYSTEM-DOMAIN<br/>
      $ bbl up
      </pre>
  
  In the above command, replace the placeholder text as follows:
  
  * `YOUR-SUBSCRIPTION-ID` is the subscription ID you selected in the previous section.
  * `YOUR-TENANT-ID` is the **tenant** field of your service principal credential.
  * `YOUR-CLIENT-ID` is the **appID** field of your service principal credential.
  * `YOUR-CLIENT-SECRET` is the **password** field of your service principal credential.
  * `YOUR-AZURE-REGION` is the region where your resource will be created, such as `eastus`. See [Azure Regions](https://azure.microsoft.com/en-us/global-infrastructure/regions/) in the Microsoft Azure documentation for more information.
  * `YOUR-CERTIFICATE.crt` and `YOUR-KEY.key` are the path to your Certificate Authority (CA) certificate and key. This enables SSL/TLS termination at your application gateway. See [Getting Started: Microsoft Azure](https://github.com/cloudfoundry/bosh-bootloader/blob/master/docs/getting-started-azure.md) in the bosh-bootloader documentation for instruction about creating them.
  <p class='note'><strong>Note</strong>: For test and development environments, you can generate your own CA certificate and key with a tool such as <a href="https://github.com/square/certstrap">certstrap</a>.</p>
  * `YOUR-SYSTEM-DOMAIN` is the DNS domain name for your Cloud Foundry instance. Cloud Foundry uses this domain name when deploying apps. For example, if you select the name `cloud.example.com`, Cloud Foundry deploys each of your apps as `APP-NAME.cloud.example.com`.
  
  The `bbl up` command takes twenty to thirty minutes to complete.
  
  When you run `bbl plan` or `bbl up`, bosh-bootloader creates, modifies, or deletes files in the `--state-dir` or present working directory.
  
  <p class="note"><strong>Note</strong>: The <strong>bbl state directory</strong>
  contains credentials and other metadata related to your BOSH Director and
  infrastructure. Copy this directory to a secure location.</p>
  
  ### View List of Values from the State File
  
  Run `bbl` to view the full list of environmental details you can extract from the state file. You must always run `bbl` from the directory that contains `bbl-state.json`. For more information about bbl commands, see the [usage.go](https://github.com/cloudfoundry/bosh-bootloader/blob/master/commands/usage.go) file in the bosh-bootloader repository on GitHub.
  
  ### Extract Information from the bbl State
  
  To extract information from the bbl state, run `bbl ENVIRONMENT-DETAIL`. Replace `ENVIRONMENT-DETAIL` with the name of one of the environmental details listed when you run the `bbl` command.
  
  For example, to obtain your BOSH Director address, run the following command:
  
  <pre class="terminal">
  $ bbl director-address
  https://YOUR-DIRECTOR-ADDRESS
  </pre>
  
  ## <a id='update-dns'></a> Step 4: Update DNS Records
  
  If you specify the `--lb-domain` flag, bbl creates an Azure DNS Zone in your resource group. You can view the records in the zone.
  
  The nameservers have the following format:
  
  
negative.code:       "password": "YOUR-CLIENT-SECRET",
        "tenant": "YOUR-TENANT-ID"
      }
      ```
      Where:
      * `YOUR-CLIENT-ID` is your client ID.
      * `YOUR-SERVICE-PRINCIPAL-DISPLAY-NAME` is the display name of your service principal.
      * `YOUR-SERVICE-PRINCIPAL-NAME` is the name of your service principal.
      * `YOUR-CLIENT-SECRET` is your client secret.
      * `YOUR-TENANT-ID` is your tenant ID.
      This is the credential for BBL to access Azure. <%= vars.recommended_by %> recommends that you copy it to a secure location. This credential is only effective in the subscription that you selected in previous step.
      <p class="note"><strong>Note:</strong> The service principal created above has default role <strong>Contributor</strong>. You may need more precise access control. For more information, see <a href="https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli?view=azure-cli-latest">Create an Azure service principal with Azure CLI</a> in the Microsoft Azure documentation.<p>
  
  
  ## <a id="create-infra-bosh"></a> Step 3: Create Infrastructure, BOSH Director, and App Gateway
  
  To create the required infrastructure, deploy a BOSH Director, and create an app gateway for <%= vars.platform_name %>:
  
  1. Run:
      
      ```
      bbl plan \
        --iaas azure \
        --azure-subscription-id YOUR-SUBSCRIPTION-ID \
        --azure-tenant-id YOUR-TENANT-ID \
  