anchor.diff:  
   ### <a id='marketplace-services'></a> Marketplace Services
   
  -Each installed Marketplace Service requires its own set of ASG rules to
  -function properly. See the installation instructions for each
  -installed Marketplace Service to determine which ASG rules it requires.
  -For more information about how to provision and integrate services, see the [Services Overview](../devguide/services/index.html) topics.
  +Each installed Marketplace Service requires its own set of ASG rules to function properly. See the installation instructions for each installed Marketplace Service to determine which ASG rules it requires. For more information about how to provision and integrate services, see the [Services Overview](../devguide/services/index.html) topics.
   
   
   ## <a id='asg-baseline'></a> About the ASG Creator Tool
   
  -The ASG Creator is a command line tool that you can use to create JSON rules
  -files.
  -The ASG Creator lets you specify IP addresses, CIDRs, and IP address ranges
  -that you want to disallow traffic to, as well as the addresses that you want to allow traffic to.
  -Based on these disallow/allow (exclude/include) lists that you provide as
  -input, the ASG Creator formulates a JSON file of allow rules.
  -
  -In turn, the JSON file is the input for the `cf create-security-group` command
  -that creates an ASG.
  -
  -You can download the latest release of the ASG Creator from the <%= vars.product_short %> incubator repository on GitHub: [https://github.com/cloudfoundry-incubator/asg-creator/releases/latest](https://github.com/cloudfoundry-incubator/asg-creator/releases/latest)
  +The ASG Creator is a command line tool that you can use to create JSON rules files. The ASG Creator lets you specify IP addresses, CIDRs, and IP address ranges that you want to disallow traffic to, as well as the addresses that you want to allow traffic to. Based on these disallow/allow (exclude/include) lists that you provide as input, the ASG Creator formulates a JSON file of allow rules.
  +
  +In turn, the JSON file is the input for the `cf create-security-group` command that creates an ASG.
  +
  +To download the latest release of the ASG Creator, see the <%= vars.product_short %> [incubator repository](https://github.com/cloudfoundry-incubator/asg-creator/releases/latest) on GitHub.
   
   
   ## <a id='logging'></a> ASG Logging
   
  -The KB article [How to use Application Security Group (ASG) logging](https://community.pivotal.io/s/article/How-to-use-Application-Security-Group-ASG-Logging) describes how you can use ASGs to correlate emitted logs back to an app.
  +For information about how you can use ASGs to correlate emitted logs back to an app, see [How to use Application Security Group (ASG) logging](https://community.pivotal.io/s/article/How-to-use-Application-Security-Group-ASG-Logging) in the Pivotal Knowledge Base.
   
   <% end %>
  
positive.code: ---
  title: Application Security Groups
  owner: Security
  ---
  
  
  
  This topic provides an overview of Application Security Groups (ASGs) in <%= vars.product_full %>, and describes how to manage and administer them. Many of the steps below require the [Cloud Foundry Command Line Interface](../cf-cli/install-go-cli.html) (cf CLI) tool.
  <%= vars.asg_first_time %>
  
  ## <a id='introduction'></a> About Application Security Groups
  
  Application Security Groups (ASGs) are a collection of egress rules that
  specify the protocols, ports, and IP address ranges where app or task instances
  send traffic.
  
  ASGs define **allow** rules, and their order of evaluation is unimportant
  when multiple ASGs apply to the same space or deployment.
  The platform sets up rules to filter and log outbound network traffic from app and task instances.
  ASGs apply to both buildpack-based and Docker-based apps and tasks.
  
  ### <a id='staging-running'></a> Staging and Running ASGs
  
  Administrators can define a `staging` ASG for app and task staging, and a `running` ASG for app and task runtime.
  
  When apps or tasks begin staging, they require traffic rules permissive enough to allow them to pull resources from the network.
  A running app or task no longer needs to pull resources, so traffic rules can be more restrictive and secure.
  To distinguish between these two security requirements, administrators can define a `staging` ASG for app and task staging with more permissive rules, and a `running` ASG for app and task runtime with less permissive rules.
  
  ### <a id='types'></a> Platform-Wide and Space-Scoped ASGs
  
  To provide granular control when securing a deployment, administrators can
  assign platform-wide ASGs that apply to all app and task instances for the entire deployment, or space-scoped ASGs that apply only to apps and tasks in a particular space.
  
  In environments with both platform-wide and space-specific ASGs, the ASGs for a particular space combine with the platform ASGs to determine the rules for that space.
  
  ### <a id='simplifying'></a> Simplifying ASGs with a Services Subnet
  
  ASGs can be complicated to configure correctly, especially when the specific IP
  addresses listed in a group change.
  
  To simplify securing a deployment while still allowing apps reach external
  services, operators can deploy the services into a subnet that is separate from
  their <%= vars.product_short %> deployment, then create ASGs for the apps that whitelist those service subnets, while denying access to any VM hosting other apps.
  
  For examples of typical ASGs, see the <a href="#typical-groups">Typical Application Security Groups</a> section below.
  
  
negative.code: 
  ### <a id='updating-groups'></a> Update ASGs
  
  To update an existing ASG, do the following:
  
  1. Edit the ASG rules in the JSON file.
  
  