anchor.diff:  installed Marketplace Service to determine which ASG rules it requires.
   For more information about how to provision and integrate services, see [Services Overview](../devguide/services/).
   
  -
   ##<a id='asg-baseline'></a> About the ASG Creator Tool
   
  -The ASG Creator is a command line tool that you can use to create JSON rules files. 
  -The ASG Creator lets you specify IP addresses, CIDRs, and IP address ranges that you want to _disallow_ traffic to,
  -as well as the addresses that you to _allow_ traffic to. 
  -Based on these disallow/allow (exclude/include) lists that you provide as input, 
  -the ASG Creator formulates a JSON file of allow rules. 
  -
  -In turn, the JSON file is the input for the `cf bind-security-group ` command that creates an ASG.  
  -
  -You can download the latest release of the ASG Creator from the Cloud Foundry incubator repository on Github, 
  -[here](https://github.com/cloudfoundry-incubator/asg-creator/releases/latest).
  +The ASG Creator is a command line tool that you can use to create JSON rules 
  +files. 
  +The ASG Creator lets you specify IP addresses, CIDRs, and IP address ranges 
  +that you want to disallow traffic to, as well as the addresses that you want to allow traffic to. 
  +Based on these disallow/allow (exclude/include) lists that you provide as 
  +input, the ASG Creator formulates a JSON file of allow rules. 
  +
  +In turn, the JSON file is the input for the `cf bind-security-group ` command 
  +that creates an ASG.  
  +
  +You can download the latest release of the ASG Creator from the Cloud Foundry incubator repository on Github:  [https://github.com/cloudfoundry-incubator/asg-creator/releases/latest](https://github.com/cloudfoundry-incubator/asg-creator/releases/latest)
  
positive.code:   </tr>
  </table>
  
  Typically, ASGs applied to staging containers are more permissive than the ASGs applied to running containers.
  This is because staging often requires access to different resources, such as dependencies.
  
  You use different commands to apply an ASG to each of the four sets. For more information, see the [Procedures](#procedures) section of this topic.
  
  <p class="note"><strong>Note</strong>: To apply a staging ASG to apps within a space, you must use the CC API. 
  The cf CLI command <code>cf bind-security-group</code> supports space-scoped running ASGs, but not space-scoped staging ASGs.</p>
  
  ### <a id='creating-groups'></a>The Structure and Attributes of ASGs ##
  
  
negative.code: |Attribute        |Description                                                                                                                                                                                                  |Notes
  |---              |---                                                                                                                                                                                                          |---
  |`protocol`       |`tcp`, `udp`, `icmp`, or `all`                                                                                                                                                                               |Required
  |`destination`    |A single IP address, an IP address range like `192.0.2.0-192.0.1-4`, or a CIDR block to allow network access to
  |`ports`          |A single port, multiple comma-separated ports, or a single range of ports that can receive traffic. Examples: `443`, `80,8080,8081`, `8080-8081`                                                            |Required when `protocol` is `tcp` or `udp`
  |`code`           |ICMP code                                                                                                                                                                                                    |Required when `protocol` is `icmp`
  |`type`           |ICMP type                                                                                                                                                                                                    |Required when `protocol` is `icmp`
  |`log`            |Set to `true` to enable logging. For more information about how to configure system logs to be sent to a syslog drain, see the <a href="../devguide/services/log-management.html">Using Log Management Services</a> topic.
  | `description`   |An optional text field for operators managing security group rules
  
  ##<a id="process"></a> Process for Administering ASGs
  
  