anchor.diff:  
   ### <a id='binding-groups'></a>Bind ASGs ##
   
  -<p class='note'><strong>Note</strong>: Binding an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  +<p class='note'><strong>Note</strong>: Binding an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.
  +</p>
   
   To apply an ASG, you must first bind it to an ASG set.
   
  
positive.code: private network ASGs as appropriate. You may find it helpful to use a naming
  convention with `private_networks` as part of the ASG name, such as `private_networks_databases`.
  
  <p class='note'><strong>Note</strong>: You should exclude any private networks and IP addresses that app and task instances should not have access to. </p>
  
  Example `private_networks` ASG:
  
  
negative.code: Example app dependencies include public Maven repositories, NPM, RubyGems, and 
  Docker registries.
  
  <p class='note'><strong>Note</strong>: You should exclude IaaS metadata endpoints, such as <code>169.254.169.254</code>, because the metadata endpoint can expose sensitive environment information to untrusted apps. The <code>public_networks</code> example below accounts for this recommendation.
  </p>
  
  Example `public_networks` ASG:
  
  