anchor.diff:  
   ## <a id='unbinding-groups'></a>Unbinding Application Security Groups ##
   
  -<p class='note'><strong>Note</strong>: Unbinding an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  +<p class='note'><strong>Note</strong>: Unbinding an ASG does not affect started applications until you restart them. To restart all of the applications in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
   
   To unbind an ASG from the `default-staging` set, run the following command:
   
  
positive.code: 
  ### <a id='dns-example'></a>DNS ###
  
  In order to resolve hostnames to IP addresses, apps require DNS server 
  connectivity, which typically use port 53. Administrators should create or
  update a `dns` ASG with appropriate rules. Administrators may further restrict
  the DNS servers to specific IP addresses or ranges of IP addresses.
  
negative.code: 
  <strong><%= modified_date %></strong>
  
  _This page assumes you are using the [Cloud Foundry Command Line Interface (cf CLI)](https://github.com/cloudfoundry/cli) v6.4 or higher._
  
  ## <a id='introduction'></a>Introduction ##
  
  This topic describes how to use and administer Application Security Groups 
  (ASG)s.
  
  ASGs are a collection of egress rules that specify the protocols, ports, and IP address ranges where application containers send outbound traffic. Because ASGs define **allow* rules, their order of evaluation is unimportant when multiple application security groups apply to the same space, org, or deployment. Application containers use these rules to filter and log outbound network traffic.
  
  When applications begin staging, they need traffic rules permissive enough to allow them to pull resources from the network. Once an application is running, the traffic rules applied to it can be more restrictive and secure. To distinguish between these two security requirements, administrators can define separate ASGs for application staging and runtime. 
  
  To provide granular control when securing a deployment, an administrator can assign ASGs to apply to all applications across a deployment, or to specific spaces or orgs within a deployment.
  
  An ASG can be complicated to configure correctly, especially when the specific IP addresses listed in the group change. To simplify securing a deployment while still allowing applications to reach external services, operators can deploy the services into a subnet separate from their Cloud Foundry deployment. Operators can then create ASGs for the applications that whitelist those service subnets, while denying access to VMs hosting other applications.
  
  For examples of typical ASGs, see the <a href="#typical-groups">Typical Application Security Groups</a> section of this topic.
  
  