anchor.diff:  
   ###<a id="c2cvsasg"></a> CF Networking versus ASGs
   
  -Both application security groups (ASGs) and CF Networking policies affect traffic from app containers.
  +Both application security groups (ASGs) and CF Networking policies affect traffic from app instances.
   The following table highlights differences between ASGs and CF Networking policies.
   
   <table>
  
positive.code:   </ul>
    </tr>
    <tr>
    <td>VXLAN Policy Agent<br>
        (You can also use an alternative such as iovisor, OVS, or iptables.)</td>
    <td>Enforces network policy for traffic between apps as follows:
    <ul>
    <li>Discovers desired network policies from the Policy Server Internal API</li>
  
negative.code: 
  #### With CF Networking
  
  The diagram below illustrates how app instances communicate in a deployment with CF Networking enabled. 
  In this example, the operator creates two policies to regulate the flow of traffic between **App A**, **App B**, and **App C**. 
  
  * Allow traffic from **App A** to **App B**
  