anchor.diff:  |Attribute        |Description                                                                                                                                                                                                  |Notes
   |---              |---                                                                                                                                                                                                          |---
   |`protocol`       |`tcp`, `udp`, `icmp`, or `all`                                                                                                                                                                               |Required 
  -|`destination`    |A single IP address, an IP address range like `192.0.2.0-192.0.2.50`, or a CIDR block to allow network access to
  +|`destination`    |A single IP address, an IP address range like `192.0.2.0-192.0.2.50`, or a CIDR block that can receive traffic.
   |`ports`          |A single port, multiple comma-separated ports, or a single range of ports that can receive traffic. Examples: `443`, `80,8080,8081`, `8080-8081`                                                            |Required when `protocol` is `tcp` or `udp`
   |`code`           |ICMP code                                                                                                                                                                                                    |Required when `protocol` is `icmp`. A value of `-1` allows all codes.
   |`type`           |ICMP type                                                                                                                                                                                                    |Required when `protocol` is `icmp`. A value of `-1` allows all types.
  -|`log`            |Set to `true` to enable logging. For more information about how to configure system logs to be sent to a syslog drain, see the <a href="../devguide/services/log-management.html">Using Log Management Services</a> topic.                                                                                                                                                                                                    |Logging is only supported when the protocol type is `tcp`.
  +|`log`            |Set to `true` to enable logging. For more information about how to configure system logs to be sent to a syslog drain, see the <a href="../devguide/services/log-management.html">Using Log Management Services</a> topic.                                                                                                                                                                                                    |Logging is only supported with protocol type `tcp`
   | `description`   |An optional text field for operators managing security group rules
   
   
  
positive.code:   </tr>
    <tr>
      <td>1.</td>
      <td>Review the existing ASGs. If this is a new deployment, probably these are the <a href="#default">Default ASGs</a> alone.</td>
      <td><a href="#viewing">View ASGs</a></td>
    </tr>
    <tr>
  
negative.code:   </tr>
  </table>
  
  Typically, ASGs applied during the staging lifecycle are more permissive than 
  the ASGs applied during the running lifecycle.
  This is because staging often requires access to different resources, such as
  dependencies.
  
  You use different commands to apply an ASG to each of the four sets. For more information, see the [Procedures](#procedures) section of this topic.
  
  <p class="note"><strong>Note</strong>: To apply a staging ASG to apps within a space, you must use the Cloud Controller (CC) API. The cf CLI <code>cf bind-security-group</code> command supports space-scoped running ASGs, but not space-scoped staging ASGs.</p>
  
  ### <a id='creating-groups'></a>The Structure and Attributes of ASGs ##
  
  