anchor.diff:      </tr>
     </table>
   
  -## <a id='initial'></a> Step 3: Create Initial ASGs ##
  +1. If your network layout includes two or more networks, continue [Step 2: Bind the Default ASG to the System Org](#bind-default).
   
  -Gather the CIDRs for each of the networks in your deployment.
  +## <a id='bind-default'></a> Step 2: Bind the Default ASG to the System Org##
  +
  +The [default ASG](../concepts/asg.htmll#default-asg) provided by Elastic Runtime allows all outbound traffic from app containers on public and private networks except for the link-local range, `169.254.0.0/16`, which is blocked.
  +
  +Follow these steps to apply the default ASG to the `system` org so that PCF system apps can continue functioning after you do [Step 4: Remove the Deployment-wide Default ASG Binding](#unbind-default).
  +
  +1. Bind the default security group to the staging set in the `system` org:
  +    <pre class="terminal">$ cf bind-staging-security-group default\_security\_group system</pre>
  +
  +1. Bind the default security group to the running set in the `system` org:
  +    <pre class="terminal">$ cf bind-running-security-group default\_security\_group system</pre>
  +
  +## <a id='initial'></a> Step 3: Create and Bind New ASGs ##
  +
  +Follow these steps to create ASGs that block apps from accessing PCF components and create any additional ASGs that allow apps to access the services they require. 
  +
  +### <a id='get-cidrs'></a> Part A: Record CIDRs from Ops Manager
  +
  +Gather the CIDRs for each network in your deployment:
   
   1. From the Ops Manager Director tile, click **Create Networks** within the **Settings** tab.
   
  
positive.code: ---
  title: Securing your Deployment with Application Security Groups
  owner: Security
  ---
  
  ## <a id='prerequisites'></a> Prerequisites ##
  
  * Download the latest release of the [ASG Creator](https://github.com/cloudfoundry-incubator/asg-creator/releases/latest) from the Cloud Foundry incubator repository on Github.
  
  ## <a id='bind-default'></a> Step 1: Bind the Default ASG ##
  
  The default ASG's name is either `all_open` or `default_security_group`. The name of the ASG depends on the version of your initial Elastic Runtime installation.
  
  1. Run the following commands:
    <pre class="terminal">
    $ cf running-security-groups
    </pre>
    
  1. Examine the output to determine which default ASG you have: `all_open` or `default_security_group`. 
  
  1. Bind the default security group to the staging set:
    * If `all_open`, run the following:
      <pre class="terminal">$ cf bind-staging-security-group all_open system</pre>
    * If `default_security_group`, run the following:
      <pre class="terminal">$ cf bind-staging-security-group default_security_group system</pre>
  
  1. Bind the default security group to the running set:
    * If `all_open`, run the following:
      <pre class="terminal">$ cf bind-running-security-group all_open system</pre>
    * If `default_security_group`, run the following:
      <pre class="terminal">$ cf bind-running-security-group default_security_group system</pre>
  
  
  ## <a id='network'></a> Step: 2 Determine your Network Layout ##
  
  The steps for securing your deployment with ASGs vary depending on your network layout. Follow this procedure to determine your network layout. 
  
  1. Log in to Ops Manager. 
  
  1. For each tile, click **Assign AZs and Networks** and record the selected **Network** the tile is installed on. 
  
  1. Based on the information you gathered, determine which of the following network layouts you have:
    <table>
  
negative.code: 
  1. Record the **CIDR** for each network.
  
  ### <a id='initial-asgs'></a> Part B: Create and Bind ASGs for your Network Layout
  
  Create ASGs that block apps from sending traffic to the networks that host Ops Manager, Elastic Runtime, and any services installed. 
  
  1. Create a `config.yml` containing the appropriate content for your network layout and replace the indicated values with the CIDRs you gathered:
    * **Two Network Layout**:
  
          ```
          excluded_networks:
          - YOUR-OPS-MANAGER-CIDR
          - YOUR-ELASTIC-RUNTIME-AND-SERVICES-CIDR
          ```
     * **Three Network Layout**:
        <p class="note"><strong>Note</strong>: If you only want to secure the Ops Manager and Elastic Runtime components, you can optionally exclude the services CIDR.</p>
  
           ```
            excluded_networks:
            - YOUR-OPS-MANAGER-CIDR
            - YOUR-ELASTIC-RUNTIME-CIDR
            - YOUR-SERVICES-CIDR
           ```
      * **Three or More Network Layout**:
        <p class="note"><strong>Note</strong>: If you only want to secure the Ops Manager and Elastic Runtime components, you can optionally exclude the services CIDRs.</p>
  
          ```
          excluded_networks:
          - YOUR-OPS-MANAGER-CIDR
          - YOUR-ELASTIC-RUNTIME-CIDR
          - YOUR-SERVICE-CIDR-1
          - YOUR-SERVICE-CIDR-2
          etc...
          ```
  
  1. Create a `json` that contains ASG rules using your `config.yml` as input by running the following command:  
    * Replace `OUTPUT-FILE-NAME` with a name of your choice. 
    <pre class="terminal">$ asg-creator create --config config.yml --output OUTPUT-FILE-NAME.json</pre>
  
  1. Create an ASG by running the following command:
    1. Replace `SECURITY-GROUP-NAME` with a name of your choice.
    1. Replace `OUTPUT-FILE-NAME` with the name of the generated file from the previous step. 
    <pre class="terminal">$ create-security-group SECURITY-GROUP-NAME OUTPUT-FILE-NAME.json</pre>
  
  1. Bind the ASG to the [default staging set](../concepts.html/asg.html#asg-sets):
    <pre class="terminal">$ cf bind-staging-security-group SECURITY-GROUP-NAME</pre>
  
  1. Bind the ASG to the [default running set](../concepts.html/asg.html#asg-sets):
    <pre class="terminal">$ cf bind-running-security-group SECURITY-GROUP-NAME</pre>
  
  ### <a id='service-access'></a> Part C: Create and Bind ASGs for Service Access
  
  Some of your developer's apps may need to communicate with a service. Follow these steps to Create ASGs that allow them to do so. 
  
  1. If either of the following is true, complete this section. Otherwise, your apps can already access services without restrictions and you can proceed to [Step 4: Remove the Deployment-wide Default ASG Binding](#unbind-default): 
    * You have a two network layout.
    * You chose to block the service network(s) in the previous step.
  
  1. Now that you have created ASGs to secure the Ops Man, Elastic Runtime, and service components, create additional ASGs to give apps access to any services they need. 
    <p class="note warning"><strong>WARNING</strong>: If you have the two network layout, then each time you create an ASG that allows apps to access a new port/protocol, you further expose the Elastic Runtime component VMs. This is a limitation of a two network layout. For guidance on network topology, see <a href="../refarch/index.html">Reference Architectures</a>.</p>
    * For example, in any space where apps need to access the MySQL for PCF service, follow the steps in [Creating Application Security Groups for MySQL](http://docs.pivotal.io/p-mysql/app-security-groups.html). 
    * For more information on creating and binding ASGs, see the following:
        * [Procedures for Working with ASGs](../concepts/asg.html#procedures)
        * [Typical ASGs](../concepts/asg.html#typical-groups) 
     
   
  
  ## <a id='unbind-default'></a> Step 4: Remove the Deployment-wide Default ASG Binding
  
  After you bind your new ASGs to the appropriate ASG sets and spaces, you can unbind the default ASG from `default-staging` and `default-running` sets:
  
  1. Unbind the default security group from the staging set:
      <pre class="terminal">$ cf unbind-staging-security-group default\_security\_group</pre>
  
  1. Unbind the default security group from the running set:
      <pre class="terminal">$ cf unbind-running-security-group default\_security\_group</pre>
  
  
  ## <a id='typical'></a> Step 5: Restart your Apps to Apply the ASGs
  
  To apply the ASG changes, you must restart all of the apps in your deployment. To mitigate app downtime during the restart, Pivotal recommends a [blue-green](../devguide/deploy-apps/blue-green.html) deployment strategy.
  
  <p class="note"><strong>Notes</strong>: You do not need to restart the apps in the <code>system</code> org.</p>
  
  1. Restart a few apps individually to test that they still work correctly with the new ASGs in place. If an app does not work as expected, you likely must create another ASG that allows the app to send traffic to a service it requires. 
    <p class="note"><strong>Note</strong>: To quickly roll back to the original overly-permissive state, you can re-bind the <code>default\_security\_group</code> ASG to the <code>default-staging</code> and <code>default-running</code> sets. You must then restart your apps to re-apply the original ASGs.</p>
  
  1. Restart the rest of your apps. Optionally, you can use the [app-restarter cf CLI plugin](https://github.com/cloudfoundry-incubator/app-restarter) to restart all apps in a particular space, org, or deployment.