anchor.diff:  
   1. **Security Groups**: The rules described by the the Default Staging set, the
   Default Running set, and all security groups bound to the space.
  -1. **Warden ALLOW rules**: Any Warden Server configuration ALLOW rules.
  +1. **Warden "allow" rules**: Any Warden Server configuration `allow` rules.
   Set Warden Server configuration rules in the Droplet Execution Agent (DEA)
   configuration section of your deployment manifest.
  -1. **Warden DENY rules**: Any Warden Server configuration DENY rules.
  -Set Warden Server configuration rules in the Droplet Execution Agent (DEA)
  -configuration section of your deployment manifest.
  -1. **Hard-coded REJECT rule**: Cloud Foundry returns a REJECT result for all
  +1. **Warden "deny" rules**: Any Warden Server configuration `deny` rules.
  +Set Warden Server configuration rules in the DEA configuration section of your 
  +deployment manifest.
  +1. **Hard-coded "reject" rule**: Cloud Foundry returns a `reject` result for all
   outbound traffic from a container if not allowed by a higher-priority rule.
   
   ## <a id='viewing'></a>Viewing Security Groups ##
  
positive.code: ```
  ## <a id='binding-groups'></a>Binding Security Groups ##
  
  A security group consists of a list of rules. You must bind this list to either an org or a space for Cloud Foundry to apply the rules to outgoing traffic.
  
  ### <a id='bind-space'></a>Binding to a Space ###
  
  Run `cf bind-security-group SECURITY-GROUP ORG SPACE` to bind a security group
  to a space.
  Cloud Foundry applies the rules that this security group defines to all
  application containers in the space.
  A space may belong to more than one security group.
  
  ### <a id='bind-org'></a>Binding to an Org ###
  
  To create an org-wide rule, you must bind a security group to the Default
  Staging or the Default Running security group set.
  Cloud Foundry applies the rules in every security group in each of these sets as
  follows:
  
  * **Default Staging**: Rules are applied to every application staged in every space in the org. To bind a security group to the Default Staging set, run `cf bind-staging-security-group SECURITY-GROUP`.
  * **Default Running**: Rules are applied to every application running in every space in the org. To bind a security group to the Default Running set, run `cf bind-running-security-group SECURITY-GROUP`.
  
  ## <a id='eval-sequence'></a>Network Traffic Rules Evaluation Sequence ##
  
  Cloud Foundry evaluates security groups and other network traffic rules in a
  strict priority order.
  Cloud Foundry returns an ALLOW, DENY, or REJECT result for the first rule that
  matches the outbound traffic request parameters, and does not evaluate any
  lower-priority rules.
  
  Cloud Foundry evaluates the network traffic rules for an application in the
  
negative.code: 
  _This page assumes that you are using cf v6.4 or higher._
  
  Application security groups act as virtual firewalls to control outbound traffic
  from the applications in your deployment.
  A security group consists of a list of network egress access rules.
  
  An administrator can assign one or more security groups to a Cloud Foundry
  deployment or to a specific
  [space](http://docs.pivotal.io/pivotalcf/concepts/roles.html#spaces) in
  an [org](http://docs.pivotal.io/pivotalcf/concepts/roles.html#orgs) within a
  deployment.
  
  <p class='note'><strong>Note</strong>: A security group assigned to a Cloud
  	Foundry deployment affects all spaces in all orgs within the deployment.</p>
  
  Within a space, Cloud Foundry runs each instance of an application inside a
  separate application container.
  When you launch an application for the first time, Cloud Foundry creates a new
  container for each application instance, then applies any space-specific and
  deployment-wide security groups to the container.
  Cloud Foundry determines whether to allow or deny outbound traffic from the
  container by evaluating the rules defined in these security groups.
  
  ## <a id='creating-groups'></a>Creating Security Groups ##
  
  A security group consists of a list of operator-defined network egress `allow`
  rules.
  These rules define the outgoing traffic allowed to application containers.
  Each rule contains the following three parts:
  
  * **Protocol**: TCP, UDP, or ICMP
  * **Open Port / Port Range**:
  