anchor.diff:  ## <a name='sharding-routers-isolation-segment'></a> Sharding Routers for Isolation Segments
   
   To provide security guarantees in addition to the firewall rules described above, an operator can configure sharding of Gorouter's routing table, resulting in a router dedicated for an isolation segment having knowledge only of routes for applications in the same isolation segment. The flexibility of the configuration also supports deployment of a router that is responsible for multiple isolation segments, or that excludes all isolation segments.
  +  
  +### Bypass Cloud Controller Bridge
  +
  +Support for router sharding depends on bypassing the [Cloud Controller Bridge](../concepts/diego/diego-architecture.html#bridge-components) (CC Bridge). To do so, set the `cc.diego.temporary_local_apps` flag to `true` in your Cloud Config file. This enables the Cloud Controller to send app creation requests containing routing isolation segment information directly to the Diego BBS, rather than through the CC Bridge. 
  +
  +Below is a sample excerpt of a [BOSH v2 Cloud Config](https://bosh.io/docs/cloud-config.html) file for GCP that shows this flag set to `true`:
  +
  +<pre><code>
  + azs:
  + - z1
  + - z2
  + instances: 2
  + jobs:
  + - consumes:
  +     consul_client:
  +       from: consul_client_link
  +     consul_common:
  +       from: consul_common_link
  +     consul_server: nil
  +   name: consul_agent
  +   properties:
  +     consul:
  +       agent:
  +         services:
  +           cloud_controller_ng: {}
  +           routing-api: {}
  +   release: consul
  + - consumes:
  +     database:
  +       from: db
  +   name: cloud_controller_ng
  +   properties:
  +     app_domains:
  +     - apps.mycloudfoundry.com
  +     app_ssh:
  +       host_key_fingerprint: ab:cd:ef:12:34:56:78:90:ab:cd:ef:12:34:56:78:90
  +     cc:
  +       diego:
  +       temporary_local_apps: true
  +</code>
  +</pre>
  +  
  +### Configure Routers for Sharding
   
   Configuration is achieved using two manifest properties, `routing_table_sharding_mode` and `isolation_segments`.
   
  
positive.code: <%= vars.pcf_networking_is3 %>
  <% end %>
  
  <% if vars.product_name == 'CF' %>
  ## <a name='config-dns-lb'></a>Step 6: Configure DNS and Load Balancers
  <% else %>
  ## <a name='config-dns-lb'></a>Step 5: Configure DNS and Load Balancers
  <% end %>
  
  Create a separate domain name for each router instance group, and configure DNS to resolve these domain names to a load balancer that routes requests to the matching routers. 
  
  
negative.code: 
  For more information about networks and subnets in GCP, see the [Using Networks and Firewalls](https://cloud.google.com/compute/docs/networking) topic in the GCP documentation.
  
  
  ##<a name='config-networks'></a> Step 2: Configure Networks for Routers
  
  <% if vars.product_name == 'CF' %>
  Below is a sample excerpt of a [BOSH v2 Cloud Config](https://bosh.io/docs/cloud-config.html) file for GCP that includes the [three example subnets](#create-networks) described above. Each subnet is associated with one BOSH AZ. For the purpose of compute isolation, each BOSH AZ is associated with a different IaaS AZ.
  