anchor.diff:  
   As described before, VNID 0 is privileged in that traffic with any VNID is
   allowed to enter any pod assigned VNID 0, and traffic with VNID 0 is allowed to
  -enter any pod.  Only the "default" OpenShift project is assigned VNID 0; all
  +enter any pod. Only the *default* OpenShift project is assigned VNID 0; all
   other projects are assigned unique, isolation-enabled VNIDs.
  -
  -==== External Access to the Cluster Network
  +endif::[]
  +
  +=== External Access to the Cluster Network
   
   If a host that is external to OpenShift requires access to the cluster network,
   you have two options:
  
positive.code: ifdef::openshift-enterprise[]
  OpenShift SDN,
  endif::[]
  which configures an overlay network using Open vSwitch (OVS). Following is a
  detailed discussion of the design and operation of OpenShift SDN, which may be
  useful for troubleshooting.
  
  OpenShift SDN provides two SDN plugins for configuring the network:
  
  * The *ovssubnet* plugin is the original plugin which provides a "flat" pod
  network where every pod can communicate with every other pod and service.
  * The *multitenant* plugin provides isolation between pods based on which
  OpenShift project the pod is assigned to.  Each project receives a unique
  Virtual Network ID (VNID) that identifies traffic from pods assigned to the
  project.  Pods from different projects cannot send packets to or receive packets
  from pods and services of a different project.
  +
  However, the "default" project (which receives VNID 0) is more privileged in
  that it is allowed to communicate with all other pods, and all other pods can
  communicate with the "default" project.  This facilitates certain services
  (like the load balancer) that are run in containers themselves and must talk
  to all other containers.
  
  == Design
  
  === Master
  
  On an OpenShift master, OpenShift SDN maintains a registry of nodes, stored in
  *etcd*. When the system administrator registers a node, OpenShift SDN allocates
  
negative.code: *_eth0_* _(in A's netns) -> *vethA* -> *br0* -> *tun0* -> (NAT) -> *eth0* (physical device) -> Internet_
  
  Almost all packet delivery decisions are performed with OpenFlow rules in the
  OVS bridge *br0*, which simplifies the plug-in network architecture and provides
  flexible routing.
  ifdef::openshift-origin[]
  In the case of the *multitenant* plug-in, this also provides enforceable network
  isolation.
  endif::[]
  
  ifdef::openshift-origin[]
  === Network Isolation With the multitenant Plug-in
  
  When using the *multitenant* plug-in, when a packet exits a pod assigned to a
  non-default project, the OVS bridge *br0* tags that packet with the project's
  assigned VNID. If the packet is directed to another IP address in the node's
  cluster subnet, the OVS bridge only allows the packet to be delivered to the
  destination pod if the VNIDs match.
  
  