anchor.diff:  To provide granular control when securing a deployment, admins can assign platform-wide ASGs that apply to all app and task instances for the entire deployment, or space-scoped ASGs that apply only to apps and tasks in a particular space.
   
   In environments with both platform-wide and space-specific ASGs, the ASGs for a particular space are combined with the platform ASGs to determine the effective rules for that space. Any of the permitted traffic in the set of applicable ASGs is then effectively permitted for that app.
  +
  +### <a id='dynamic-asgs'></a> Dynamic ASGs
  +
  +Dynamic ASGs allow ASGs to be applied to apps without the need for an application restart. Only containers using <a href="https://github.com/cloudfoundry/silk-release">the silk-cni</a> will have their ASGs updated dynamically, with Windows apps and apps using other CNI's (e.g., NSX-T) not supporting Dynamic ASGs at this time.
  +Dynamic ASGs are enabled with cf-deployment XXX and above via <a href="https://github.com/cloudfoundry/cf-networking-release/releases/tag/3.0.0">cf-networking-release 3.0.0</a>. It is recommended to use Dynamic ASGs in conjunction with capi-release v1.126.0 or later for improved performance on the /v3/security_groups APIs.
  +
  +To disable Dynamic ASGs: use the ops file `operations/disable-dynamic-asgs.yml` from <a href="https://github.com/cloudfoundry/cf-deployment/releases/tag/XXX">cf-deployment XXX</a> or higher.
   
   ### <a id='simplifying'></a> Simplifying ASGs with a Services Subnet
   
  
positive.code:     cf update-security-group example-asg ~/workspace/example-asg-v2.json
      ```
  
  <p class='note'><strong>Note:</strong> Updating an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  
  ### <a id='unbinding-groups'></a> Unbind ASGs
  
  <p class='note'><strong>Note:</strong> Unbinding an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  
  To unbind an ASG from the platform-wide staging ASG set:
  
  
negative.code: 
  ### <a id='binding-groups'></a> Bind ASGs
  
  <p class='note'><strong>Note:</strong> Binding an ASG does not affect started apps unless you have [Dynamic ASGs](#dynamic-asgs) enabled. If disabled, you will need restart the apps. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  
  To apply an ASG, you must first bind it to an ASG set.
  
  