anchor.diff:  
   1. <a href="#binding-groups">Bind the ASG</a>.
   
  -###<a id='asg-baseline'></a>Create Baseline ASGs
  -
  -ASG Creator is a CLI tool to generate baseline ASGs that introduce a list of network access
  -rules for all application containers. You can use this baseline ASG prevent access to specific networks and individual IP addresses. The ASG rules files generated by ASG Creator contain those IP 
  -address ranges that application containers are allowed access to. 
  -
  -To use ASG Creator to create baseline ASGs, perform the following steps:
  -
  -1. Download the latest [release](https://github.com/cloudfoundry-incubator/asg-creator/releases/latest) of ASG Creator.
  -1. Create a configuration file named `config.yml` that contains the networks and IP addresses you want to blacklist. Follow the format of the example below, and consult the table for descriptions of the attributes.
  -
  -    ```yaml
  -    excluded_ips:
  -    - 192.0.2.4
  -
  -    excluded_networks:
  -    - 192.0.2.0/24
  -    ```
  -
  -    |Attribute|Description
  -    |---|---
  -    |excluded_ips|An array of IP addresses to exclude. ASG Creator omits these addresses from the baseline ASG rules.
  -    |excluded_networks|An array of CIDRs to exclude. ASG Creator omits all IP addresses in these networks from the baseline ASG rules.
  -
  -1. Run `asg-creator create`, supplying the `config.yml`, to create the
  -baseline ASG rules files **public-networks.json** and **private-networks.json**.
  -
  -    <pre class="terminal">
  -    $ asg-creator create --config config.yml
  -    Wrote public-networks.json
  -    Wrote private-networks.json
  -    OK
  -    </pre>
  -
  -    <p class='note'><strong>Note</strong>: If you do not supply a configuration file, ASG Creator only excludes <code>169.254.169.254</code> from <code>public-networks.json</code>.
  -
  -1. Review the generated ASG rules files, **public-networks.json** and **private-networks.json**, and make changes in accordance with your network policy for application containers running untrusted code.
  -
  -1. Run the following cf CLI commands with the ASG rules files to create baseline staging and running ASGs:
  -
  -    <pre class="terminal">
  -    $ cf create-security-group YOUR-PRIVATE-NETWORKS-SECURITY-GROUP private-networks.json
  -    $ cf bind-staging-security-group YOUR-PRIVATE-NETWORKS-SECURITY-GROUP 
  -    $ cf bind-running-security-group YOUR-PRIVATE-NETWORKS-SECURITY-GROUP 
  -
  -    $ cf create-security-group YOUR-PUBLIC-NETWORKS-SECURITY-GROUP public-networks.json
  -    $ cf bind-staging-security-group YOUR-PUBLIC-NETWORKS-SECURITY-GROUP 
  -    $ cf bind-running-security-group YOUR-PUBLIC-NETWORKS-SECURITY-GROUP 
  -    </pre>
  -
   ## <a id='updating-groups'></a>Updating ASGs ##
   
   <p class='note'><strong>Note</strong>: Updating an ASG does not affect started applications until you restart them. To restart all of the applications in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  
positive.code: <pre class="terminal">
  $ cf bind-security-group SECURITY-GROUP ORG
  </pre>
  
  ## <a id='unbinding-groups'></a>Unbinding ASGs ##
  
  
negative.code: 
  ## <a id="asg-sets"></a> ASG Sets ##
  
  There are four ASG sets in Cloud Foundry:
  
  + Platform-wide staging ASG set
  + Platform-wide running ASG set
  + Space-scoped staging ASG set
  + Space-scoped running ASG set
  
  The following table indicates the differences among the four sets.
  
  <table>
    <tr>
      <th>When an ASG is bound to the... </th>
      <th>the ASG rules are applied to...</th>
      <th>that are... </th>
    </tr>
    <tr>
      <td>Platform-wide staging ASG set</td>
      <td>all containers</td>
      <td>staging source code for apps and task during the staging lifecycle phase.
  </td>
    </tr>
    <tr>
      <td>Platform-wide running ASG set</td>
      <td>all containers</td>
      <td>running apps or tasks.</td>
    </tr>
    <tr>
      <td>Space-scoped staging ASG set</td>
      <td>containers in one space</td>
      <td>staging source code for apps and task during the staging lifecycle phase.</td>
    </tr>
    <tr>
      <td>Space-scoped running ASG set</td>
      <td>containers in one space</td>
      <td>running apps or tasks.</td>
    </tr>
  </table>
  
  Typically, ASGs applied to staging containers are more permissive than the ASGs applied to running containers. 
  This is because staging often requires access to different resources, such as dependencies.
  
  You need to use different commands to apply an ASG to each of the four sets. See below.
   
  <p class="note"><strong>Note</strong>: Currently, Cloud Foundry supports the use of space-scoped ASGs 
  for staging application containers only through the CC API. 
  Application of ASGs to staging containers in a single org is not yet supported by the cf CLI. 
   </p>
  
  ## <a id='viewing'></a>View ASGs ##
  
  Run the following commands to view information about existing ASGs:
  
  