anchor.diff:  
   _This page assumes you are using [cf Command Line Interface tool](https://github.com/cloudfoundry/cli) (cf CLI) v6.4.0 or later._
   
  +
   ## <a id='introduction'></a>Introduction ##
   
  -This topic describes how to use and administer Application Security Groups 
  -(ASG)s.
  -
  -ASGs are a collection of egress rules that specify the protocols, ports, and IP address ranges where application containers (for either LRPs or tasks) send outbound traffic. Because ASGs define *allow* rules, their order of evaluation is unimportant when multiple ASGs apply to the same space, org, or deployment. Application containers use these rules to filter and log outbound network traffic.
  -
  -When applications or tasks begin staging, they need traffic rules permissive enough to allow them to pull resources from the network. After an application or task is running, the traffic rules can be more restrictive and secure. To distinguish between these two security requirements, administrators can define one ASG for application and task staging and another for application and task runtime. 
  -
  -To provide granular control when securing a deployment, an administrator can assign ASGs to apply to all applications across a deployment, or to specific spaces or orgs within a deployment.
  -
  -ASGs can be complicated to configure correctly, especially when the specific IPs listed in the group change. To simplify securing a deployment while still permitting apps to reach external services, operators can deploy the services into a subnet that is separate from their Cloud Foundry deployment. Then the operators can create ASGs for the apps that whitelist those service subnets, while denying access to any VMs hosting other apps.
  +This topic provides an overview of Application Security Groups (ASG)s and describes how to 
  +manage and administer them. 
  +
  +Most of the procedures in this topic require admin role. 
  +Other roles are limited to viewing ASGs.
  +
  +###ASGs
  +
  +ASGs are a collections of egress rules that specify the protocols, ports, and IP address ranges 
  +where containers (for either apps or tasks) send traffic. 
  +Because ASGs define *allow* rules, their order of evaluation is unimportant when multiple ASGs 
  +apply to the same space or deployment. 
  +Containers use these rules to filter and log outbound network traffic. 
  +ASGs apply to both Buildpack-based and Docker-based containers in both the app and task lifecycle phases.
  +
  +When apps or tasks begin staging, they need traffic rules permissive enough 
  +to allow them to pull resources from the network. 
  +After an app or task is running, the traffic rules can be more restrictive and secure. 
  +To distinguish between these two security requirements, 
  +administrators can define one ASG for app and task staging, and another for app and task runtime. 
  +
  +To provide granular control when securing a deployment, an administrator can assign ASGs to 
  +apply to all containers across a deployment or to specific spaces within a deployment.
  +
  +ASGs can be complicated to configure correctly, especially when the specific IPs listed in the group change. 
  +To simplify securing a deployment while still permitting apps to reach external services, 
  +operators can deploy the services into a subnet that is separate from their Cloud Foundry deployment. 
  +Then the operators can create ASGs for the apps that whitelist those service subnets, while denying access to any VMs hosting other apps.
   
   For examples of ASGs, see <a href="#typical-groups">Typical ASGs</a> below.
   
  
positive.code: private network ASGs as appropriate. It may be helpful to use a naming
  convention with `private_networks` as part of the ASG name, such as `private_networks_databases`.
  
  <p class='note'><strong>Note</strong>: Be sure to exclude any private networks and IP addresses that application containers should not have access to. </p>
  
  Example `private_networks` ASG:
  
  
negative.code:         "protocol": "tcp",
          "destination": "10.0.11.0/24",
          "ports": "80,443",
          "log": true,
          "description": "Allow http and https traffic from ZoneA"
        }
      ]
      </pre>
  