anchor.diff:  
   As described before, VNID 0 is privileged in that traffic with any VNID is
   allowed to enter any pod assigned VNID 0, and traffic with VNID 0 is allowed to
  -enter any pod.  Only the "default" OpenShift project is assigned VNID 0; all
  +enter any pod. Only the *default* OpenShift project is assigned VNID 0; all
   other projects are assigned unique, isolation-enabled VNIDs.
  -
  -==== External Access to the Cluster Network
  +endif::[]
  +
  +=== External Access to the Cluster Network
   
   If a host that is external to OpenShift requires access to the cluster network,
   you have two options:
  
positive.code: *_eth0_* _(in A's netns) -> *vethA* -> *br0* -> *tun0* -> (NAT) -> *eth0* (physical device) -> Internet_
  
  Almost all packet delivery decisions are performed with OpenFlow rules in the
  OVS bridge *br0*.  This simplifies the network architecture of the multitenant
  plugin and provides flexible routing and (in the case of the *multitenant*
  plugin) enforceable network isolation.
  
  ==== Network Isolation With the multitenant Plugin
  
  When using the *multitenant* plugin, when a packet exits a pod assigned to a
  non-default project, the OVS bridge *br0* tags that packet with the project's
  assigned VNID.  If the packet is directed to another IP address in the node's
  cluster subnet, the OVS bridge only allows the packet to be delivered to the
  destination pod if the VNIDs match.
  
  
negative.code: access to containers via the cluster network, unless it is also running as a
  node.
  
  ifdef::openshift-origin[]
  When using the *multitenant* plug-in, the OpenShift SDN master also watches for
  the creation and deletion of projects, and assigns VXLAN VNIDs to them, which
  will be used later by the nodes to isolate traffic correctly.
  endif::[]
  
  [[sdn-design-on-nodes]]
  
  == Design on Nodes
  
  On a node, OpenShift SDN first registers the local host with the SDN master in
  the aforementioned registry so that the master allocates a subnet to the node.
  
  Next, OpenShift SDN creates and configures six network devices:
  
  * *br0*, the OVS bridge device that containers will be attached to. OpenShift
  SDN also configures a set of non-subnet-specific flow rules on this bridge.
  ifdef::openshift-origin[]
  The *multitenant* plug-in does this immediately.
  endif::[]
  The *ovssubnet* plug-in waits to do so until the SDN master announces the
  creation of the new node subnet.
  * *lbr0*, a Linux bridge device, which is configured as Docker's bridge and
  given the cluster subnet gateway address (eg, 10.1.x.1/24).
  * *tun0*, an OVS internal port (port 2 on *br0*). This _also_ gets assigned the
  