anchor.diff:      - 10.1.200.15
       static:
       - 10.1.200.11-10.1.200.15
  -    <strong>az: z4</strong>
  +    **az: z4**
       cloud_properties:
         ephemeral_external_ip: true
  -      <strong>network_name: sample-network</strong>
  -      <strong>subnetwork_name: sample-subnet-is1-az2</strong>
  +      **network_name: sample-network**
  +      **subnetwork_name: sample-subnet-is1-az2**
         tags:
  -      - <strong>sample-is1</strong>
  -</code>
  -</pre>
  +      - **sample-is1**
  +```
   
   ### AWS Cloud Config
   
   <p class="note"><strong>Note:</strong> AWS networking requires security groups, which need to be created separately. In the below example, the operator must create the <strong>sample-<%= vars.app_runtime_abbr_lc %>-is</strong> and <strong>sample-is1</strong> security groups.</p>
   
  -<pre>
  -<code>
  +```
   azs:
   - name: z1
     cloud_properties:
  
positive.code: 
      <table>
        <tr>
        <th width="20%">Rule Name</th>
        <th width="20%">Source</th>
        <th width="20%">Allowed Protocols/Ports</th>
        <th width="20%">Destination</th>
        <th width="20%">Reason</th>
        </tr>
        <tr> 
        <td><code><%= vars.app_runtime_abbr_lc %>-to-bosh</code></td>
        <td><%= vars.app_runtime_abbr %> isolation segment</td>
        <td><code>tcp</code></td>
        <td>BOSH Director</td>
        <td>BOSH Agent on VMs in the <%= vars.app_runtime_abbr %> Diego Cells to reach BOSH Director</td>
        </tr>
        <tr>
        <td><code>bosh-to-<%= vars.app_runtime_abbr_lc %></code></td>
        <td>BOSH Director</td>
        <td><code>tcp</code></td>
        <td><%= vars.app_runtime_abbr %> Diego Cells</td>
        <td>BOSH director to control VMs in the <%= vars.app_runtime_abbr %> Diego Cells</td>
        </tr>
        <tr>
        <td><code><%= vars.app_runtime_abbr_lc %>-internal</code></td>
        <td><%= vars.app_runtime_abbr %> Diego Cells</td>
        <td><code>tcp</code></td>
        <td><%= vars.app_runtime_abbr %> Diego Cells</td>
        <td>VMs within the <%= vars.app_runtime_abbr %> Diego Cells to reach one another</td>
        </tr>
        <tr>
        <td><code><%= vars.app_runtime_abbr_lc %>-to-is1</code></td>
        <td><%= vars.app_runtime_abbr %> Diego Cells</td>
        <td><code>tcp:1801,8853,9100</code></td>
        <td>Isolation segment</td>
        <td>Diego BBS in <%= vars.app_runtime_abbr %> Diego Cells to reach Diego Cells in isolation segment</td>
        </tr>
        <tr>
        <td><code>is1-to-bosh</code></td>
        <td>Isolation segment</td>
        <td><code>tcp:4222,25250,25777</code></td>
        <td>BOSH Director</td>
        <td>BOSH agent on VMs in isolation segment to reach BOSH Director</td>
        </tr>
        <tr>
        <tr>
        <td><code>is1-internal</code></td>
        <td>Isolation segment</td>
        <td><code>tcp</code></td>
        <td>Isolation segment</td>
        <td>VMs within isolation segment to reach one another</td>
        </tr>
        <tr>
        <td><code>is1-to-<%= vars.app_runtime_abbr_lc %></code></td>
        <td>Isolation segment</td>
        <td><code>tcp:3000,3457,4003<br>4103,4222,8080<br>8082,8083,8443,8447,8844
        	<br>8853,8889,8891<br>9000,9022,9023,9090,9091<br></code>
        <br><br>
        For information about the processes that use these ports and their corresponding manifest properties, see <a href="#port-reference">Port Reference Table</a>.
        </td>
        <td><%= vars.app_runtime_abbr %> Diego Cells</td>
        <td>Diego Cells in isolation segment to reach BBS, Auctioneer, and CredHub in <%= vars.app_runtime_abbr %> Diego Cells. Loggregator Agent to reach Traffic Controller. Routers to reach NATS, UAA, and Routing API.</td>
        </tr>
      </table>
  
  
negative.code:     - 10.0.200.15
      static:
      - 10.0.200.11-10.0.200.15
      **az: z3**
      cloud_properties:
        ephemeral_external_ip: true
        **network_name: sample-network**
        **subnetwork_name: sample-subnet-is1-az1**
        tags:
        - **sample-is1**
    - range: 10.1.200.0/28
      gateway: 10.1.200.1
      reserved:
  