anchor.diff:  
   <strong><%= modified_date %></strong>
   
  -This topic describes how operators can configure and manage routing for isolation segments. Operators can deploy an additional set of routers for each isolation segment called a router group to handle requests for applications within the segment.
  +This topic describes how operators can configure and manage routing for isolation segments. Operators can deploy an additional set of routers for each isolation segment to handle requests for applications within the segment.
   
   For more information about how isolation segments work, see the [Isolation Segments](../concepts/security.html#isolation-segments) section of the <em>Understanding Cloud Foundry Security</em> topic. <%= vars.install_isolation_segments %>
   
  
positive.code: 
  For more information about networks and subnets in GCP, see the [Using Networks and Firewalls](https://cloud.google.com/compute/docs/networking) topic in the GCP documentation.
  
  ##<a id='config-networks'></a> Step 2: Configure Networking
  
  <% if vars.product_name == 'CF' %>
  Edit the [BOSH cloud config](https://bosh.io/docs/cloud-config.html) by following the procedures below.
  
  ###<a id='subnets-azs'></a> Associate Subnets with AZs
  
  Associate each subnet with the BOSH logical availability zone (AZ) where instances of each component will be deployed.
  
  Below is a sample excerpt of a [BOSH v2 cloud config](https://bosh.io/docs/cloud-config.html) file for GCP that includes the [three example subnets](#create-networks) described above. Each subnet is associated with one BOSH AZ. For the purpose of compute isolation, each BOSH AZ is associated with a different IaaS AZ.
  
  <pre><code>
  
negative.code:   - name: private
  </code>
  </pre>
  
  ## <a id='add-routers'></a>Step 4: Add Routers to Load Balancer
  
  For some IaaS (e.g. AWS, GCP), the BOSH Cloud Config and deployment manifest can be used to instruct BOSH to add routers to the IaaS load balancers automatically. For others, operators must assign static IPs to the routers in the manifest and assign these IPs to the load balancers out of band.
  
  For deployments to GCP, associate the router instance groups with load balancers by first configuring a backend service which describes the load balancer rules. Next, define the backend service in the Cloud Config with a `vm_extension`. Finally, associate the router instance groups with the `vm_extention`. In the following example, the `vm_extension` called `cf-router-network-properties` is defined in the cloud config with a GCP backend service.
    
    ```
    instance_groups:
  