anchor.diff:  
   ### <a id='dns-example'></a>DNS ###
   
  -In order to resolve hostnames to IP addresses, apps require DNS server 
  +In order to resolve hostnames to IP addresses, applications require DNS server 
   connectivity, which typically use port 53. Administrators should create or
   update a `dns` ASG with appropriate rules. Administrators may further restrict
   the DNS servers to specific IP addresses or ranges of IP addresses.
  
positive.code: <%= partial '../opsguide/default_asg' %>
  <% end %>
  
  ### <a id="asg-sets"></a> ASG Sets
  
  ASG sets are sets of containers to which the ASGs are applied. 
  These sets of containers are differentiated by _scope_, platform-wide or space-specific containers,
  and _function_, staging or running containers. 
  
  Currently, there are four ASG sets in Cloud Foundry:
  
  + Platform-wide staging ASG set (also called default-staging)
  + Platform-wide running ASG set (also called default-running)
  + Space-scoped staging ASG set
  + Space-scoped running ASG set
  
  The following table indicates the differences between the four sets.
  
  <table>
    <tr>
      <th>When an ASG is bound to the... </th>
      <th>the ASG rules are applied to...</th>
      <th>that are... </th>
    </tr>
    <tr>
      <td>Platform-wide staging ASG set</td>
      <td>all containers</td>
      <td>staging source code for apps and task during the staging lifecycle phase.
  </td>
    </tr>
    <tr>
      <td>Platform-wide running ASG set</td>
      <td>all containers</td>
      <td>running apps or tasks.</td>
    </tr>
    <tr>
      <td>Space-scoped staging ASG set</td>
      <td>containers in one space</td>
      <td>staging source code for apps and task during the staging lifecycle phase.</td>
    </tr>
    <tr>
      <td>Space-scoped running ASG set</td>
      <td>containers in one space</td>
      <td>running apps or tasks.</td>
    </tr>
  </table>
  
  Typically, ASGs applied to staging containers are more permissive than the ASGs applied to running containers. 
  This is because staging often requires access to different resources, such as dependencies.
  
  You use different commands to apply an ASG to each of the four sets. See [Procedures](#procedures) below.
   
  <p class="note"><strong>Note</strong>: Currently, Cloud Foundry supports the use of space-scoped ASGs 
  for staging containers only through the CC API. 
  Application of ASGs to staging containers in a single space is not yet supported by the cf CLI. 
   </p>
  
  ### <a id='creating-groups'></a>The Structure and Attributes of ASGs ##
  
  ASG rules are specified as a JSON array of ASG objects. An ASG object has the following attributes:
  
  
negative.code: 
  Each installed Marketplace Service requires its own set of ASG rules to
  function properly. Refer to the installation instructions for each
  installed Marketplace Service to determine which ASG rules it requires. See the [Services Overview](../devguide/services/) topic for more information about how to provision and integrate services.
  