anchor.diff:      $ cf network-policies --source frontend
       Listing network policies in org my-org / space dev as admin...
   
  -    source      destination   protocol   ports
  -    frontend    backend       tcp        8080
  +    source      destination   protocol   ports    destination space    destination org
  +    frontend    backend       tcp        8080     example-space        example-org
       </pre>
   
   ### <a name="rm-policy"></a> Remove a Network Policy
   
   To remove a policy that allows direct network traffic from an app, run the following command:
   
  -```cf remove-network-policy SOURCE_APP --destination-app DESTINATION_APP --protocol PROTOCOL --port RANGE
  +```cf remove-network-policy SOURCE_APP --destination-app DESTINATION_APP -s DESTINATION_SPACE_NAME -o DESTINATION_ORG_NAME --protocol PROTOCOL --port RANGE
   ```
   
   Replace the placeholders in the above command to match an existing policy, as follows:
   
   * `SOURCE_APP` is the name of the app that sends traffic.
   * `DESTINATION_APP` is the name of the app that receives traffic.
  +* `DESTINATION_SPACE_NAME` is the space of the destination app. The default is the targeted space. 
  +* `DESTINATION_ORG_NAME` is the org of the destination app. The default is the targeted org. 
   * `PROTOCOL` is either `tcp` or `udp`.
   * `PORTS` are the ports connecting the apps. The allowed range is from `1` to `65535`. You can specify a single port, such as `8080`, or a range of ports, such as `8080-8090`.
   
  
positive.code: 
  ### <a name="prereq"></a> Prerequisites
  
  * Ensure that you are using cf CLI v6.30 or higher:
  <pre class="terminal">
  $ cf version
  </pre>
  
negative.code: 
  To add a policy that allows direct network traffic from one app to another, run the following command:
  
  ```cf add-network-policy SOURCE_APP --destination-app DESTINATION_APP -s DESTINATION_SPACE_NAME -o DESTINATION_ORG_NAME --protocol (tcp | udp) --port RANGE
  ```
  
  Replace the placeholders in the above command as follows:
  
  * `SOURCE_APP` is the name of the app that sends traffic.
  * `DESTINATION_APP` is the name of the app that will receive traffic.
  * `DESTINATION_SPACE_NAME` is the space of the destination app. The default is the targeted space. 
  * `DESTINATION_ORG_NAME` is the org of the destination app. The default is the targeted org. 
  * `PROTOCOL` is one of the following: `tcp` or `udp`.
  * `RANGE` are the ports at which to connect to the destination app. The allowed range is from `1` to `65535`. You can specify a single port, such as `8080`, or a range of ports, such as `8080-8090`.
  
  