anchor.diff:  
   ## <a id='updating-groups'></a>Updating Application Security Groups ##
   
  -<p class='note'><strong>Note</strong>: Updating an ASG does not affect started applications until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  -
  -To update an existing ASG, run the following command, replacing `SECURITY-GROUP` with the name of your security group and `PATH-TO-RULES-FILE` with the absolute or relative path to a rules file.
  +<p class='note'><strong>Note</strong>: Updating an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  +
  +To update an existing ASG, run the following command, replacing `SECURITY-GROUP` with the name of your security group, and `PATH-TO-RULES-FILE` with the absolute or relative path to a rules file.
   <pre class="terminal">
   $ cf update-security-group SECURITY-GROUP PATH-TO-RULES-FILE
   </pre>
   
   ## <a id='binding-groups'></a>Binding Application Security Groups ##
   
  -<p class='note'><strong>Note</strong>: Binding an ASG does not affect started applications until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  +<p class='note'><strong>Note</strong>: Binding an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
   
   To apply an ASG to application containers, you must first bind it to a default set or a space.
   
  
positive.code: |Attribute        |Description                                                                                                                                                                                                  |Notes
  |---              |---                                                                                                                                                                                                          |---
  |`protocol`       |`tcp`, `udp`, `icmp`, or `all`                                                                                                                                                                               |Required
  |`destination`    |A single IP address, an IP address range (e.g. 192.0.2.0-192.0.1-4), or a CIDR block to allow network access to
  |`ports`          |A single port, multiple comma-separated ports, or a single range of ports that can receive traffic, e.g. `"443"`, `"80,8080,8081"`, `"8080-8081"`                                                            |Required when `protocol` is `tcp` or `udp`
  |`code`           |ICMP code                                                                                                                                                                                                    |Required when `protocol` is `icmp`
  |`type`           |ICMP type                                                                                                                                                                                                    |Required when `protocol` is `icmp`
  |`log`            |Set to `true` to enable logging. For more information about how to configure system logs to be sent to a syslog drain, see <a href="../devguide/services/log-management.html">Using Log Management Services</a> topic.
  | `description`   |This is an optional field that contains useful text for operators to manage security group rules. <%= vars.asg_desc %>
  
  
  Follow the instructions in the sections below to create [individual ASGs](#asg-individual) and [baseline ASGs](#asg-baseline).
  
negative.code: |`cf security-groups`                |All security groups
  |`cf staging-security-groups`        |All security groups in the `default-staging` set
  |`cf running-security-groups`        |All security groups in the `default-running` set
  |`cf security-group SG-NAME`         |All rules in the security group specified by `SG-NAME`
  
  ## <a id='creating-groups'></a>Creating Application Security Groups ##
  
  <p class='note'><strong>Note</strong>: After creating an ASG, you must bind it for it to take effect. See the <a href="#binding-groups">Binding Application Security Groups</a> section of this topic for more information.</p>
  
  ASG rules are specified as a JSON array of ASG objects. An ASG object has the following attributes:
  
  