anchor.diff:  The policies you create specify a source app, destination app, protocol, and port so that apps can communicate directly 
   without going through the Gorouter, a load balancer, or a firewall. 
   Container networking in CF supports UDP and TCP, and you can configure policies for multiple ports. 
  -These policies are applied immediately without having to restart the app. 
  +These policies are applied immediately without having to restart the app. For more information, see the [Create Policies for Container Networking](#create-policies) section.
   
   The container-networking BOSH release is composed of a pluggable network stack, which means you can swap several components. 
   For more information, see [Architecture](#architecture) below. 
  
positive.code: * Allow traffic from **App A** to **App B**
  * Allow traffic from **App A** to **App C**
  
  If traffic and its direction is not explicitly allowed, it is denied. In this case, **App B** cannot send traffic to **App C**.
  
  ![Post Container Networking](./images/post-c2c.png)
  
  
negative.code: 
  ##<a id="enable"></a>Enable Container Networking
  
  This section describes how to enable container networking for CF deployments that run on an IaaS, as well as BOSH-Lite deployments. See the section that corresponds to your use case. 
  
  ###<a id="iaas"></a>Enable on IaaS
  
  If your CF deployment runs on an IaaS, follow these steps to enable container networking.
  
  <ol>
      <li>Ensure that you have a database ready. To complete this procedure, you need a MySQL or PostgreSQL database. 
  You can use an instance within the Cloud Controller database or spin up another instance, such as Amazon RDS.</li>
      <li>Target your bosh director using the BOSH CLI:<br>
      <code>
      $ bosh target BOSH-DIRECTOR-IP
  