anchor.diff:  * Requests for applications in an isolation segment must not share networking resources with requests for other applications.
   * The Cloud Foundry management plane should only be accessible from a private network. As multiple IaaS load balancers cannot typically share the same pool of backends, such as Cloud Foundry routers, each load balancer requires an additional deployment of routers.
   
  -##<a id='create-networks'></a> Step 1: Create Networks
  +##<a name='create-networks'></a> Step 1: Create Networks
   
   ### Create a network or subnet for each isolation segment on your infrastructure
   
  
positive.code: 
  <%= image_tag('is-sharing-domains.png') %>
  
  ##<a id='config-firewall'></a> Step 7: Configure Firewall Rules
  
  Configure firewall rules to allow necessary traffic between the shared isolation segments (`sample-shared-is`) and the private isolation segments (`sample-is1` and `sample-is2`). Assuming a default deny-all rule, these rules should prevent a request with a spoofed Host header from being forwarded by a router to an application in another isolation segment.
  
  
negative.code: 
  The sections below describe a configuration that routes applications from [distinct domain names](#distinct-domain), and a configuration that routes applications from a [shared domain name](#sharing-domain). The diagrams illustrate a topology with separate load balancers, but you could also use one load balancer with multiple interfaces.
  
  ### <a name='distinct-domain'></a>Distinct Domain Names
  
  In a configuration that routes applications from distinct domain names:
  
  