anchor.diff:  | `description`   |An optional text field for operators managing security group rules. <%= vars.asg_desc %>
   
   
  -Follow the instructions in the sections below to create [individual ASGs](#asg-individual) and [baseline ASGs](#asg-baseline).
  -
  -###<a id='asg-individual'></a>Create Individual ASGs
  -
  -To create individual ASGs, perform the following steps:
  +Follow the instructions in the sections below to create [ASGs](#asg-individual).
  +
  +###<a id='asg-individual'></a>Create an ASG
  +
  +To create an ASG, perform the following steps. After the ASG is created, it can be applied to one or more of the four ASG sets. See [#binding-groups](Bind ASGs) below.
   
   1. Create a **rules** file: a JSON-formatted single array containing objects that describe the rules. Refer to the example below, which allows ICMP traffic of code `1` and type `0` to all destinations, and TCP traffic to `10.0.11.0/24` on ports `80` and `443`:
   
  
positive.code: 
  1. <a href="#binding-groups">Bind the ASG</a>.
  
  ###<a id='asg-baseline'></a>Create Baseline ASGs
  
  ASG Creator is a CLI tool to generate baseline ASGs that introduce a list of network access
  rules for all application containers. You can use this baseline ASG prevent access to specific networks and individual IP addresses. The ASG rules files generated by ASG Creator contain those IP 
  address ranges that application containers are allowed access to. 
  
  To use ASG Creator to create baseline ASGs, perform the following steps:
  
  1. Download the latest [release](https://github.com/cloudfoundry-incubator/asg-creator/releases/latest) of ASG Creator.
  1. Create a configuration file named `config.yml` that contains the networks and IP addresses you want to blacklist. Follow the format of the example below, and consult the table for descriptions of the attributes.
  
      ```yaml
      excluded_ips:
      - 192.0.2.4
  
      excluded_networks:
      - 192.0.2.0/24
      ```
  
      |Attribute|Description
      |---|---
      |excluded_ips|An array of IP addresses to exclude. ASG Creator omits these addresses from the baseline ASG rules.
      |excluded_networks|An array of CIDRs to exclude. ASG Creator omits all IP addresses in these networks from the baseline ASG rules.
  
  1. Run `asg-creator create`, supplying the `config.yml`, to create the
  baseline ASG rules files **public-networks.json** and **private-networks.json**.
  
      <pre class="terminal">
      $ asg-creator create --config config.yml
      Wrote public-networks.json
      Wrote private-networks.json
      OK
      </pre>
  
      <p class='note'><strong>Note</strong>: If you do not supply a configuration file, ASG Creator only excludes <code>169.254.169.254</code> from <code>public-networks.json</code>.
  
  1. Review the generated ASG rules files, **public-networks.json** and **private-networks.json**, and make changes in accordance with your network policy for application containers running untrusted code.
  
  1. Run the following cf CLI commands with the ASG rules files to create baseline staging and running ASGs:
  
      <pre class="terminal">
      $ cf create-security-group YOUR-PRIVATE-NETWORKS-SECURITY-GROUP private-networks.json
      $ cf bind-staging-security-group YOUR-PRIVATE-NETWORKS-SECURITY-GROUP 
      $ cf bind-running-security-group YOUR-PRIVATE-NETWORKS-SECURITY-GROUP 
  
      $ cf create-security-group YOUR-PUBLIC-NETWORKS-SECURITY-GROUP public-networks.json
      $ cf bind-staging-security-group YOUR-PUBLIC-NETWORKS-SECURITY-GROUP 
      $ cf bind-running-security-group YOUR-PUBLIC-NETWORKS-SECURITY-GROUP 
      </pre>
  
  ## <a id='updating-groups'></a>Updating ASGs ##
  
  <p class='note'><strong>Note</strong>: Updating an ASG does not affect started applications until you restart them. To restart all of the applications in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  
negative.code: Each installed Marketplace Service requires its own set of ASG rules to
  function properly. Refer to the installation instructions for each
  installed Marketplace Service to determine which ASG rules it requires. See the [Services Overview](../devguide/services/) topic for more information about how to provision and integrate services.
  
  ##<a id='asg-baseline'></a> About the ASG Creator Tool
  
  The ASG Creator is a command line tool that you can use to create JSON rules files. 
  The ASG Creator lets you specify IP addresses, CIDRs, and IP address ranges that you want to _disallow_ traffic to,
  as well as the addresses that you to _allow_ traffic to. 
  Based on these disallow/allow (exclude/include) lists that you provide as input, 
  the ASG Creator formulates a JSON file of allow rules. 
  
  In turn, the JSON file is the input for the `cf bind-security-group ` command that creates an ASG.  
  
  You can download the latest release of the ASG Creator from the Cloud Foundry incubator repository on Github, 
  [here](https://github.com/cloudfoundry-incubator/asg-creator/releases/latest).
  