anchor.diff:  $ cf create-security-group my-asg ~/workspace/my-asg.json
   </pre>
   
  -After the ASG is created, you must bind it to an ASG set before it takes effect.
  -See <a href="#binding-groups">Bind ASGs</a> below.
  +After the ASG is created, you must bind it to an ASG set before it takes effect. See <a href="#binding-groups">Bind ASGs</a> below.
   
   ### <a id='binding-groups'></a> Bind ASGs
   
  -<p class='note'><strong>Note</strong>: Binding an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.
  +<p class='note'><strong>Note:</strong> Binding an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.
   </p>
   
   To apply an ASG, you must first bind it to an ASG set.
  
positive.code: 
  ### <a id='marketplace-services'></a> Marketplace Services
  
  Each installed Marketplace Service requires its own set of ASG rules to
  function properly. See the installation instructions for each
  installed Marketplace Service to determine which ASG rules it requires.
  For more information about how to provision and integrate services, see the [Services Overview](../devguide/services/index.html) topics.
  
  
  ## <a id='asg-baseline'></a> About the ASG Creator Tool
  
  The ASG Creator is a command line tool that you can use to create JSON rules
  files.
  The ASG Creator lets you specify IP addresses, CIDRs, and IP address ranges
  that you want to disallow traffic to, as well as the addresses that you want to allow traffic to.
  Based on these disallow/allow (exclude/include) lists that you provide as
  input, the ASG Creator formulates a JSON file of allow rules.
  
  In turn, the JSON file is the input for the `cf create-security-group` command
  that creates an ASG.
  
  You can download the latest release of the ASG Creator from the <%= vars.product_short %> incubator repository on GitHub: [https://github.com/cloudfoundry-incubator/asg-creator/releases/latest](https://github.com/cloudfoundry-incubator/asg-creator/releases/latest)
  
  
  ## <a id='logging'></a> ASG Logging
  
  The KB article [How to use Application Security Group (ASG) logging](https://community.pivotal.io/s/article/How-to-use-Application-Security-Group-ASG-Logging) describes how you can use ASGs to correlate emitted logs back to an app.
  
  <% end %>
  
negative.code: 
  ### <a id='deleting-groups'></a> Delete ASGs
  
  <p class='note'><strong>Note:</strong> You can only delete unbound ASGs. To unbind ASGs, see <a href="#unbinding-groups">Unbind ASGs</a> above.
  </p>
  
  To delete an ASG, run `cf delete-security-group SECURITY-GROUP`. Replace `SECURITY-GROUP` with the name of your security group.
  