anchor.diff:    |_____ IaaS subnet: sample-subnet-shared
     |
     |_____ IaaS subnet: sample-subnet-is1
  -  |
  -  |_____ IaaS subnet: sample-subnet-is2
  +```
  +
  +Subnets do not generally span IaaS availability zones, so the same operator with two availability zones will need four subnets
  +
  +```
  +IaaS network: sample-network
  +|
  +|_____ IaaS subnet: sample-subnet-shared-az1
  +|
  +|_____ IaaS subnet: sample-subnet-shared-az2
  +|
  +|_____ IaaS subnet: sample-subnet-is1-az1
  +|
  +|_____ IaaS subnet: sample-subnet-is1-az2
  +
   ```
   
   For more information about networks and subnets in GCP, see the [Using Networks and Firewalls](https://cloud.google.com/compute/docs/networking) topic in the GCP documentation.
  
positive.code: <td>Diego Cells in <code>sample-is1</code> to reach BBS and Auctioneer in <code>sample-shared-is</code>, Consul Agent to reach Consul, Metron Agent to reach Traffic Controller, and Routers to reach NATS, UAA, and Routing API</td>
  </tr>
  <tr>
  <td><code>is2-to-bosh</code></td>
  <td><code>sample-subnet-is2</code></td>
  <td><code>tcp:22,6868,25555,<br>4222,25250</code></td>
  <td><code>sample-bosh</code></td>
  <td>BOSH agent on VMs in <code>sample-is2</code> to reach BOSH Director</td>
  </tr>
  <tr>
  <td><code>is2-internal</code></td>
  <td><code>sample-subnet-is2</code></td>
  <td><code>tcp</code></td>
  <td><code>sample-is2</code></td>
  <td>VMs within <code>sample-is2</code> to reach one another</td>
  </tr>
  <tr>
  <td><code>is2-to-shared</code></td>
  <td><code>sample-subnet-is2</code></td>
  <td><code>tcp:9090,9091,8082,8300,<br>8301,8302,8889,8443,3000,<br> 4443,8080,3457,9023,9022,<br>4222</code>
  <code>udp:8301,8302,8600</code>
  <br><br>
  See <a href="#port-reference">Port Reference Table</a> for information about the processes that use these ports and their corresponding manifest properties.
  </td>
  <td><code>sample-shared-is</code></td>
  <td>Diego Cells in <code>sample-is2</code> to reach BBS and Auctioneer in <code>sample-shared-is</code>, Consul Agent to reach Consul, Metron Agent to reach Traffic Controller, and Routers to reach NATS, UAA, and Routing API</td>
  </tr>
  </table>
  
  For more information consult the following topics:
  
  * The `bosh-deployment` GitHub [repo](https://github.com/cloudfoundry/bosh-deployment) contains documentation describing ports used by agents to communicate with BOSH.
  
negative.code: 
  ##<a name='config-firewall'></a> Step 6: Configure Firewall Rules
  
  Configure firewall rules to allow necessary traffic between the shared isolation segments (`sample-shared-is`) and the private isolation segments (`sample-is1`).
  Assuming a default deny-all rule, these rules should prevent a request with a spoofed Host header from being forwarded by a router to an application in another isolation segment.
  Firewall rules are specific to each IaaS, so the exact definition of `Source` and `Destination` depends on the IaaS.
  For example, on GCP a `Source` is a subnet and a `Destination` is a tag. On AWS, both `Source` and `Destination` are security groups.
  
  <table>
  <tr>
  <th>Rule Name</th>
  <th>Source</th>
  <th>Allowed Protocols/Ports</th>
  <th>Destination</th>
  <th>Reason</th>
  </tr>
  <tr>
  <td><code>shared-to-bosh</code></td>
  <td><code>sample-shared-is</code></td>
  <td><code>tcp:22,6868,25555,<br>4222,25250</code></td>
  <td><code>sample-bosh</code></td>
  <td>BOSH Agent on VMs in <code>sample-shared-is</code> to reach BOSH Director</td>
  </tr>
  <tr>
  <td><code>bosh-to-shared</code></td>
  <td><code>sample-bosh</code></td>
  <td><code>tcp</code></td>
  <td><code>sample-shared-is</code></td>
  <td>BOSH director to control VMs in <code>sample-shared-is</code></td>
  </tr>
  <tr>
  <td><code>shared-internal</code></td>
  <td><code>sample-shared-is</code></td>
  <td><code>tcp</code></td>
  <td><code>sample-shared-is</code></td>
  <td>VMs within <code>sample-shared-is</code> to reach one another</td>
  </tr>
  <tr>
  <td><code>shared-to-is1</code></td>
  <td><code>sample-shared-is</code></td>
  <td><code>tcp:1801</code></td>
  <td><code>sample-is1</code></td>
  <td>Diego BBS in <code>sample-shared-is</code> to reach Cells in <code>sample-is1</code></td>
  </tr>
  <tr>
  <td><code>is1-to-bosh</code></td>
  <td><code>sample-is1</code></td>
  <td><code>tcp:22,6868,25555,<br>4222,25250</code></td>
  <td><code>sample-bosh</code></td>
  <td>BOSH agent on VMs in <code>sample-is1</code> to reach BOSH Director</td>
  </tr>
  <tr>
  <tr>
  <td><code>bosh-to-is1</code></td>
  <td><code>sample-bosh</code></td>
  <td><code>tcp</code></td>
  <td><code>sample-is1</code></td>
    <td>BOSH director to control VMs in <code>sample-is1</code></td>
  </tr>
  <tr>
  <td><code>is1-internal</code></td>
  <td><code>sample-is1</code></td>
  <td><code>tcp</code></td>
  <td><code>sample-is1</code></td>
  <td>VMs within <code>sample-is1</code> to reach one another</td>
  </tr>
  <tr>
  <td><code>is1-to-shared</code></td>
  <td><code>sample-is1</code></td>
  <td><code>tcp:9090,9091,8082,8300,<br>8301,8302,8889,8443,3000,<br> 4443,8080,3457,9023,9022,<br>4222</code>
  <code>udp:8301,8302,8600</code>
  <br><br>
  