anchor.diff:  |Attribute        |Description                                                                                                                                                                                                  |Notes
   |---              |---                                                                                                                                                                                                          |---
   |`protocol`       |`tcp`, `udp`, `icmp`, or `all`                                                                                                                                                                               |Required
  -|`destination`    |A single IP address, an IP address range like `192.0.2.0-192.0.1-4`, or a CIDR block to allow network access to.
  -|`ports`          |A single port, multiple comma-separated ports, or a single range of ports that can receive traffic. Examples: `443`, `80,8080,8081`, `8080-8081`.                                                            |Required when `protocol` is `tcp` or `udp`
  +|`destination`    |A single IP address, an IP address range like `192.0.2.0-192.0.1-4`, or a CIDR block to allow network access to
  +|`ports`          |A single port, multiple comma-separated ports, or a single range of ports that can receive traffic. Examples: `443`, `80,8080,8081`, `8080-8081`                                                            |Required when `protocol` is `tcp` or `udp`
   |`code`           |ICMP code                                                                                                                                                                                                    |Required when `protocol` is `icmp`
   |`type`           |ICMP type                                                                                                                                                                                                    |Required when `protocol` is `icmp`
   |`log`            |Set to `true` to enable logging. For more information about how to configure system logs to be sent to a syslog drain, see the <a href="../devguide/services/log-management.html">Using Log Management Services</a> topic.
  -| `description`   |An optional text field for operators managing security group rules.
  +| `description`   |An optional text field for operators managing security group rules
   
   ##<a id="process"></a> Process for Administering ASGs
   
  
positive.code: Network connections that are commonly allowable in private networks include
  endpoints such as proxy servers, Docker registries, load balancers, databases,
  messaging servers, directory servers, and file servers. Configure appropriate
  private network ASGs as appropriate. It may be helpful to use a naming
  convention with `private_networks` as part of the ASG name, such as `private_networks_databases`.
  
  <p class='note'><strong>Note</strong>: Be sure to exclude any private networks and IP addresses that containers should not have access to. </p>
  
negative.code:   </tr>
  </table>
  
  Typically, ASGs applied to staging containers are more permissive than the ASGs 
  applied to running containers.
  This is because staging often requires access to different resources, such as 
  dependencies.
  
  You use different commands to apply an ASG to each of the four sets. For more information, see the [Procedures](#procedures) section of this topic.
  
  <p class="note"><strong>Note</strong>: To apply a staging ASG to apps within a space, you must use the CC API. The cf CLI command <code>cf bind-security-group</code> supports space-scoped running ASGs, but not space-scoped staging ASGs.</p>
  
  ### <a id='creating-groups'></a>The Structure and Attributes of ASGs ##
  
  