anchor.diff:  
   ## <a id='typical-groups'></a>Typical Application Security Groups ##
   
  -Below are examples of typical ASGs. Configure your ASGs in
  -accordance with your organization’s network access policy for untrusted
  -applications.
  +Below are examples of typical ASGs. Configure your ASGs in accordance with your organization;s network access policy for untrusted applications.
   
   |ASG                   |For access to
   |---                   |---
   |`dns`                 |DNS, either public or private
   |`public-networks`     |Public networks, excluding IaaS metadata endpoints
  -|`private-networks`    |Private networks per [RFC-1918](https://tools.ietf.org/html/rfc1918#section-3)
  -|`load-balancers`      |The internal <%= vars.product_full %> load balancer, others
  +|`private-networks`    |Private networks in accordane with  [RFC-1918](https://tools.ietf.org/html/rfc1918#section-3)
  +|`load-balancers`      |The internal <%= vars.product_full %> load balancer and others
   |`internal-proxies`    |Internal proxies
   |`internal-databases`  |Internal databases
   
   ### <a id='dns-example'></a>DNS ###
   
  -In order to resolve hostnames to IPs, applications require DNS server
  +In order to resolve hostnames to IP addresses, apps require DNS server 
   connectivity, which typically use port 53. Administrators should create or
   update a `dns` ASG with appropriate rules. Administrators may further restrict
  -the DNS servers to specific IPs or ranges of IPs.
  +the DNS servers to specific IP addresses or ranges of IP addresses.
   
   Example `dns` ASG:
   
  
positive.code: $ cf bind-security-group SECURITY-GROUP ORG SPACE
  </pre>
  
  To bind an ASG to all of an organization's existing spaces, run the following command (requires CF CLI 6.20.0+):
  
  <pre class="terminal">
  $ cf bind-security-group SECURITY-GROUP ORG
  
negative.code:     OK
      </pre>
  
      <p class='note'><strong>Note</strong>: If you do not supply a configuration file, ASG Creator only excludes <code>169.254.169.254</code> from <code>public-networks.json</code>.
  
  1. Review the generated ASG rules files, **public-networks.json** and **private-networks.json**, and make changes in accordance with your network policy for application containers running untrusted code.
  
  1. Run the following cf CLI commands with the ASG rules files to create baseline staging and running ASGs:
  
      <pre class="terminal">
      $ cf create-security-group YOUR-PRIVATE-NETWORKS-SECURITY-GROUP private-networks.json
  