anchor.diff:  
   ### <a id='binding-groups'></a> Bind ASGs
   
  -<p class='note'><strong>Note:</strong> Binding an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.
  -</p>
  +<p class='note'><strong>Note:</strong> Binding an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
   
   To apply an ASG, you must first bind it to an ASG set.
   
  
positive.code: owner: Security
  ---
  
  <<<<<<< HEAD
  This topic provides an overview of App Security Groups (ASGs) in <%= vars.product_full %>, and describes how to manage and administer them. Many of the steps below require the [Cloud Foundry Command Line Interface](../cf-cli/install-go-cli.html) (cf CLI) tool.
  =======
  
  
  This topic provides an overview of Application Security Groups (ASGs), and describes how to manage and administer them. Many of the steps below require the [Cloud Foundry Command Line Interface](../cf-cli/install-go-cli.html) (cf CLI) tool.
  >>>>>>> f696ae7e954a40e0d4e60f222e46f7e7a1d2f032
  <%= vars.asg_first_time %>
  
  ## <a id='introduction'></a> Overview
  
  
negative.code: 
  ASGs can be complicated to configure correctly, especially when the specific IP addresses listed in a group change.
  
  To simplify securing a deployment while still allowing apps reach external services, operators can deploy the services into a subnet that is separate from their <%= vars.product_short %> deployment, then create ASGs for the apps that allow those service subnets, while denying access to any VM hosting other apps.
  
  For examples of typical ASGs, see the <a href="#typical-groups">Typical Application Security Groups</a> section below.
  
  