anchor.diff:  Network connections that are commonly allowable in private networks include
   endpoints such as proxy servers, Docker registries, load balancers, databases,
   messaging servers, directory servers, and file servers. Configure appropriate
  -private network ASGs as appropriate. It may be helpful to use a naming
  +private network ASGs as appropriate. You may find it helpful to use a naming
   convention with `private_networks` as part of the ASG name, such as `private_networks_databases`.
   
   <p class='note'><strong>Note</strong>: Be sure to exclude any private networks and IP addresses that containers should not have access to. </p>
  
positive.code: 
  ## <a id='introduction'></a>Introduction ##
  
  This topic provides an overview of Application Security Groups (ASG)s and describes how to 
  manage and administer them. 
  
  ###<a id="defn"></a>ASGs
  
  ASGs are a collections of egress rules that specify the protocols, ports, and IP address ranges 
  where app or task containers send traffic. 
  Because ASGs define *allow* rules, their order of evaluation is unimportant when multiple ASGs 
  apply to the same space or deployment. 
  Containers use these rules to filter and log outbound network traffic. 
  ASGs apply to both Buildpack-based and Docker-based containers in both the app and task lifecycle phases.
  
  When apps or tasks begin staging, they need traffic rules permissive enough 
  to allow them to pull resources from the network. 
  After an app or task is running, the traffic rules can be more restrictive and secure. 
  To distinguish between these two security requirements, 
  administrators can define one ASG for app and task staging, and another for app and task runtime. 
  
  To provide granular control when securing a deployment, an administrator can assign ASGs to 
  apply to all containers across a deployment or to specific spaces within a deployment.
  
  ASGs can be complicated to configure correctly, especially when the specific IP addresses listed in a group change. 
  To simplify securing a deployment while still permitting apps reach external services, 
  operators can deploy the services into a subnet that is separate from their Cloud Foundry deployment. 
  Then the operators can create ASGs for the apps that whitelist those service subnets, 
  while denying access to any virtual machine (VMs) hosting other apps.
  
  For examples of typical ASGs, see the <a href="#typical-groups">Typical Application Security Groups</a> section of this topic.
  
  
negative.code: |Attribute        |Description                                                                                                                                                                                                  |Notes
  |---              |---                                                                                                                                                                                                          |---
  |`protocol`       |`tcp`, `udp`, `icmp`, or `all`                                                                                                                                                                               |Required
  |`destination`    |A single IP address, an IP address range like `192.0.2.0-192.0.1-4`, or a CIDR block to allow network access to
  |`ports`          |A single port, multiple comma-separated ports, or a single range of ports that can receive traffic. Examples: `443`, `80,8080,8081`, `8080-8081`                                                            |Required when `protocol` is `tcp` or `udp`
  |`code`           |ICMP code                                                                                                                                                                                                    |Required when `protocol` is `icmp`
  |`type`           |ICMP type                                                                                                                                                                                                    |Required when `protocol` is `icmp`
  |`log`            |Set to `true` to enable logging. For more information about how to configure system logs to be sent to a syslog drain, see the <a href="../devguide/services/log-management.html">Using Log Management Services</a> topic.
  | `description`   |An optional text field for operators managing security group rules
  
  ##<a id="process"></a> Process for Administering ASGs
  
  