anchor.diff:  ## <a id="default-set"></a>Default ASG Sets ##
   
   <%= vars.product_full %> has two default sets of ASGs: `default-staging` and
  -`default-running`. All application containers in <%= vars.product_full %> use a
  -base policy from one of these.
  +`default-running`. All application containers in <%= vars.product_full %> use 
  +one of these as a base policy.
   
   The `default-staging` ASG set applies to application containers that are in the
   staging application lifecycle phase. This includes both the buildpack staging
   and Docker staging process.
   
   The `default-running` ASG set applies to application containers that are
  -started and running applications.
  +started, and to running applications.
   
   In addition to the `default-staging` and `default-running` ASG sets, administrators can configure additional ASGs and bind them to <%= vars.product_full %>
   [spaces](../concepts/roles.html#spaces). ASGs bound to spaces add network
   access only to the application containers within that space.
   
  -When <%= vars.product_full %> creates an application container, the egress rules for the application
  -container include the following:
  +When <%= vars.product_full %> creates an application container, the egress rules for the application container include the following:
   
   * All ASGs in either the `default-staging` or `default-running` set
   * All ASGs bound to the space of the application
  
positive.code: |Attribute        |Description                                                                                                                                                                                                  |Notes
  |---              |---                                                                                                                                                                                                          |---
  |`protocol`       |`tcp`, `udp`, `icmp`, or `all`                                                                                                                                                                               |Required
  |`destination`    |A single IP address, an IP address range (e.g. 192.0.2.0-192.0.1-4), or a CIDR block to allow network access to
  |`ports`          |A single port, multiple comma-separated ports, or a single range of ports that can receive traffic, e.g. `"443"`, `"80,8080,8081"`, `"8080-8081"`                                                            |Required when `protocol` is `tcp` or `udp`
  |`code`           |ICMP code                                                                                                                                                                                                    |Required when `protocol` is `icmp`
  |`type`           |ICMP type                                                                                                                                                                                                    |Required when `protocol` is `icmp`
  |`log`            |Set to `true` to enable logging. For more information about how to configure system logs to be sent to a syslog drain, see <a href="../devguide/services/log-management.html">Using Log Management Services</a> topic.
  | `description`   |This is an optional field that contains useful text for operators to manage security group rules. <%= vars.asg_desc %>
  
  
  Follow the instructions in the sections below to create [individual ASGs](#asg-individual) and [baseline ASGs](#asg-baseline).
  
negative.code:     ]
      </pre>
  
  1. Run the following [Cloud Foundry Command Line Interface](../cf-cli/install-go-cli.html) (cf CLI) command, replacing 
  `SECURITY-GROUP` with the name of your security group, and `PATH-TO-RULES-FILE` 
  with the absolute or relative path to a rules file.
  <pre class="terminal">
  $ cf create-security-group SECURITY-GROUP PATH-TO-RULES-FILE
  </pre>
  