anchor.diff:  <% else %>
   This is enabled by following the steps in [Configure Validation of App Instance Identity with TLS](#app-valid-tls-config). 
   <% end %>
  +
   
   ## <a id="consistency"></a> Preventing Misrouting
   
  
positive.code: - Increased guarantees against misrouting by validating the identity of backends before forwarding requests
  - Increased security by encrypting data in flight from the Gorouter to backends
  
  <p class='note warning'><strong>WARNING:</strong> TLS routing requires an additional 32&nbsp;MB of RAM capacity on your Diego cells per app instance, as well as additional CPU capacity. Check the total amount of Diego cell memory available to allocate in your environment, and if it is less than 32&nbsp;MB times the number of running app instances, scale out your Diego cells.</p>
  
  <p class='note warning'><strong>WARNING:</strong> You may see an increase of memory and CPU usage for your Gorouters after enabling TLS routing. Check the total amount of memory and CPU usage of the Gorouters in your environment, and if they are close to the size limit, consider scaling out your Gorouters before enabling TLS routing.</p>
  
  In this mode, the Diego Route-Emitters send a modified route registration message to NATS that includes a unique identifier for the app instance, as well instructions to use TLS when communicating with the instance. See [TLS to Apps and Other Back End Services](#tls-to-back-end) for details.
  
  Before forwarding traffic to an app instance, the Gorouter initiates a TLS handshake with an [Envoy proxy](https://www.envoyproxy.io/) running in each app container. In the TLS handshake, the Envoy proxy presents a certificate generated by Diego for each container which uniquely identifies the container using the same app instance identifier sent by the Route-Emitter, configured in the certificate as a domain Subject Alternative Name (SAN).
  
  If the Gorouter confirms that the app instance identifier in the certificate matches the one received in the route registration message, the Gorouter forwards the HTTP request over the TLS session, and the Envoy proxy then forwards it to the app process. If the instance identifiers do not match, the Gorouter removes the app instance from its routing table and transparently retries another instance of the app.
  
  
negative.code: 
  ### <a id="without-tls"></a> Without TLS Enabled
  
  In this consistency mode, the Diego Route-Emitters on each cell send route registration messages that include instructions for the Gorouter to send unencrypted requests to the app instance. If the Gorouter does not receive an update for the route within the time-to-live (TTL) interval, the route is pruned from the Gorouter's routing table. For more information, see [TLS to Apps and Other Back End Services](#tls-to-back-end).
  
  This pruning method was developed before the alternative was available.
  
  