anchor.diff:    	<th>Security of traffic between Gorouter and Containers</th>
     	<th>Gorouter Route Pruning</th>
     </tr><tr>
  -  	<td><a href="#consistency-with-tls"><strong>With TLS Enabled</strong></a></td>
  +  	<td><a href="#with-tls"><strong>With TLS Enabled</strong></a></td>
     	<td>Encrypted via TLS</td>
     	<td>Routes are pruned on failure of TLS handshake only. See <a href="#when-tls-prune">Gorouter TLS pruning behavior.</a></td>
     </tr><tr>
  
positive.code:   </tr>
  </table>
  
  Both modes are described below.
  
  ### <a id="consistency-with-tls"></a>With TLS Enabled
  
  This mode is newer and has the following benefits:
  
  - Improved availability for applications by keeping routes in Gorouters routing table when TTL expires
  - Increased guarantees against misrouting, by validating the identity of back ends before forwarding requests
  
negative.code: <%= partial '../console/router_app_tls_pcf' %>
  <% end %>
  
  ### <a id="without-tls"></a>Without TLS Enabled
  
  In this consistency mode, the Diego Route Emitters on each cell send route registration messages that include instructions for Gorouter to send unencrypted requests to the app instance. If Gorouter does not receive an update for the route within the time-to-live (TTL) interval, the route is pruned from Gorouter's routing table. See [TLS to Apps and Other Back-End Services](#tls-to-back-end) for details.
  
  This pruning method was developed before the alternative was available.
  
  <% if vars.product_name.include? "CF" %>
  
  ### <a id="config-by-instance-group"></a>Consistency Mode Can Differ by Instance Group
  
  The Gorouter can [validate app instance identity using TLS](#with-tls) only when Diego cells are configured appropriately. Because cells are configured for TLS through the instance group that they belong to, the Gorouter can run in different consistency modes with cells in different instance groups. For example, the Gorouter can communicate over TLS and validate the cells in one Isolation Segment, while communicating with cells in another Isolation Segment via plain text and [without validating instance identity](#without-tls).
  
  Currently, only Linux cells support the Gorouter validating app instance identities [using TLS](#with-tls). With Windows cells, the Gorouter runs [without TLS enabled](#without-tls), forwarding requests to Windows apps over plain text and pruning based on route TTL.
  
  <% end %>
  
  