anchor.diff:  |`code`           |ICMP code                                                                                                                                                                                                    |Required when `protocol` is `icmp`
   |`type`           |ICMP type                                                                                                                                                                                                    |Required when `protocol` is `icmp`
   |`log`            |Set to `true` to enable logging. For more information on how to configure system logs to be sent to a syslog drain see <a href="../devguide/services/log-management.html">Using Log Management Services</a>
  -| `description`   |This is an optional field that contains useful text for operators to manage security group rules.
  +<%= vars.app_sec_group_desc %>
   
   Follow the instructions in the sections below to create [individual ASGs](#asg-individual) and [baseline ASGs](#asg-baseline).
   
  
positive.code: code 1 and type 0 to all destinations, and TCP traffic to 10.0.11.0/24 on ports
  80-443:
  
      ```
      [
        {
          "protocol": "icmp",
  
negative.code:         "protocol": "tcp",
          "destination": "10.0.11.0/24",
          "ports": "80-443",
          "log": true<%= vars.appsecgroupdesc1 %> 
        }
      ]
      </pre>
  
  1. Run the following cf CLI command, replacing `SECURITY-GROUP` with the name of your security group and `PATH-TO-RULES-FILE` with the absolute or relative path to a rules file.
  <pre class="terminal">
  