anchor.diff:      - cf-router-lb-security-group # to allow traffic to the load balancer
   ```
   
  +<p class="note"><strong>Note</strong>:  The load balancer `sample-is1-elb` must be created separately.</p>
  +
   <p class="note"><strong>Note</strong>: If necessary, configure a firewall rule to allow traffic from your load balancer to the Gorouters.</p>
   
   
  
positive.code:   - cf-router-sample-is1-network-properties
  ```
  
  The `vm_extension` is IaaS specific and defined in Cloud Config. Below is an example AWS cloud config. Note that the load balancer `sample-is1-elb` must be created separately.
  
  ```
  vm_extensions:
  
negative.code: 
  In a configuration that routes applications from distinct domain names:
  
  * Requests for system domain `*.cf-system.com` and the shared domain `*.shared-apps.com` are forwarded to the routers for the shared isolation segment.
  * Requests for private domain `*.private-domain.com` are forwarded to the routers for IS1.
  
  <%= image_tag('is-distinct-domains.png') %>
  
  ### <a name='sharing-domain'></a>Shared Domain Name
  
  It is a common requirement for applications on separate isolation segments to be accessible at domain names that share a domain, such as `private-domain.com`. To achieve this configuration while also obeying the guideline for forwarding requests for a domain to only one router instance group, create a new Cloud Foundry domain for a needed subdomain, such as `*.foo.private-domain.com.`
  
  In this configuration: 
  
  * Requests for system domain `*.cf-system.com` and the shared domain `*.shared-apps.com` are forwarded to the routers for the shared isolation segment.
  * Requests for private domain `*.foo.private-domain.com` are forwarded to the routers for IS1.
  Requests for private domain `*.private-domain.com` are forwarded to the routers for IS2.
  
  