anchor.diff:  [{"protocol":"tcp","destination":"10.0.11.0/24","ports":"1-65535"},
   {"protocol":"udp","destination":"10.0.11.0/24","ports":"1-65535"}]
   ```
  -## <a id='binding-groups'></a>Binding Security Groups ##
  +## <a id='binding-groups'></a>Binding Application Security Groups ##
   
   A security group consists of a list of rules.
   You must bind this list to either your entire deployment or to a space in an
  
positive.code: 
  _This page assumes you are using cf CLI v6.4 or higher._
  
  Application security groups act as virtual firewalls to control outbound traffic
  from the applications in your deployment.
  A security group consists of a list of network egress access rules.
  
  An administrator can assign one or more security groups to a Cloud Foundry
  deployment or to a specific [space](../concepts/roles.html#spaces) in an
  [org](../concepts/roles.html#orgs) within a deployment.
  
  <p class='note'><strong>Note</strong>: A security group assigned to a Cloud
  	Foundry deployment affects all spaces in all orgs within the deployment.</p>
  
  Within a space, Cloud Foundry runs each instance of an application inside a
  separate application container.
  When you launch an application for the first time, Cloud Foundry creates a new
  container for each application instance, then applies any space-specific and
  deployment-wide security groups to the container.
  Cloud Foundry determines whether to allow or deny outbound traffic from the
  container by evaluating the rules defined in these security groups.
  
  ## <a id='creating-groups'></a>Creating Security Groups ##
  
  A security group consists of a list of operator-defined network egress `allow`
  rules.
  These rules define the outgoing traffic allowed to application containers.
  Each rule contains the following three parts:
  
negative.code: 
  <p class='note'><strong>Note</strong>: New security rules apply to new containers as they are created, but not to containers that are already running when the rules are created. To apply new security rules immediately, restart all running apps in the relevant space, or across your whole installation if the new rules are for all spaces.</p>
  
  To apply the rules in an ASG to your entire Cloud Foundry deployment,
  bind the group to either the **Default Staging** or the **Default Running** group set.
  Cloud Foundry applies the rules in every application security group in the Default Staging and Default Running sets to all applications in your Cloud Foundry deployment.
  
  <p class='note'><strong>Note</strong>: If you do not bind an application security group to
  either the <a href="#bind-org">Default Staging</a> or the <a href="#bind-org">Default Running</a> set, Cloud Foundry only
  applies the rules to applications created in the specific space where you bound
  the ASG.</p>
  
  ### <a id='bind-org'></a>Binding to your Cloud Foundry Deployment ###
  
  To create a rule to be applied to every space in every org of your Cloud Foundry
  deployment, bind the group to either the **Default Staging** or the
  **Default Running** application security group set.
  
  Cloud Foundry applies the rules in every ASG in these sets as
  follows:
  
  * **Default Staging**: Cloud Foundry applies rules in this set to every application staged anywhere in your CF deployment. To bind a security group to the Default Staging set, run `cf bind-staging-security-group SECURITY-GROUP`.
  