anchor.diff:  
   <%= image_tag('is-sharing-domains.png') %>
   
  -##<a id='config-firewall'></a> Step 7: Configure Firewall Rules
  +<% if vars.product_name == 'CF' %>
  +##<a name='config-firewall'></a> Step 7: Configure Firewall Rules
  +<% else %>
  +##<a name='config-firewall'></a> Step 6: Configure Firewall Rules
  +<% end %>
   
   Configure firewall rules to allow necessary traffic between the shared isolation segments (`sample-shared-is`) and the private isolation segments (`sample-is1` and `sample-is2`). Assuming a default deny-all rule, these rules should prevent a request with a spoofed Host header from being forwarded by a router to an application in another isolation segment.
   
  
positive.code: <%= vars.pcf_networking_is3 %>
  <% end %>
  
  ## <a id='config-dns-lb'></a>Step 6: Configure DNS and Load Balancers
  
  Create a separate domain name for each router instance group, and configure DNS to resolve these domain names to a load balancer that routes requests to the matching routers. 
  
  
negative.code: The `router_shared` router will register all routes that do not have an `isolation_segment` value.
  The `router_is1` router will only register routes that have an `isolation_segment` value of `is1`.
  
  ##<a name='isolation-segments-metrics'></a>Metrics for Routers Associated with Isolation Segments
  
  For metrics emitted by the Gorouter, metrics can be distinguished by the name of the job.
  For example, the following line is a metric emitted on `uptime`:
  