anchor.diff:  * **Destination**: Destination of the traffic allowed by this rule as an IP address or CIDR block
   
   Run `cf create-security-group SECURITY-GROUP PATH-TO-RULES-FILE` from a command
  -line to create a security group named `SECURITY-GROUP`.
  +line to create an application security group named `SECURITY-GROUP`.
   `PATH-TO-RULES-FILE` can be an absolute or relative path to a rules file.
   The rules file must be a JSON-formatted single array containing objects that
   describe the rules.
  
positive.code: 
  _This page assumes you are using cf CLI v6.4 or higher._
  
  Application security groups act as virtual firewalls to control outbound traffic
  from the applications in your deployment.
  A security group consists of a list of network egress access rules.
  
  An administrator can assign one or more security groups to a Cloud Foundry
  deployment or to a specific [space](../concepts/roles.html#spaces) in an
  [org](../concepts/roles.html#orgs) within a deployment.
  
  <p class='note'><strong>Note</strong>: A security group assigned to a Cloud
  	Foundry deployment affects all spaces in all orgs within the deployment.</p>
  
  Within a space, Cloud Foundry runs each instance of an application inside a
  separate application container.
  When you launch an application for the first time, Cloud Foundry creates a new
  container for each application instance, then applies any space-specific and
  deployment-wide security groups to the container.
  Cloud Foundry determines whether to allow or deny outbound traffic from the
  container by evaluating the rules defined in these security groups.
  
  ## <a id='creating-groups'></a>Creating Security Groups ##
  
  A security group consists of a list of operator-defined network egress `allow`
  rules.
  These rules define the outgoing traffic allowed to application containers.
  Each rule contains the following three parts:
  
negative.code: 
  Run `cf bind-security-group SECURITY-GROUP ORG SPACE` to bind a security group
  to a specific space.
  Cloud Foundry applies the rules that this ASG defines to all
  application containers in the space.
  A space may belong to more than one application security group.
  
  ## <a id='eval-sequence'></a>Rules Evaluation Sequence ##
  
  When multiple ASGs apply to a single container, any one of them can allow an outgoing message from its application. Because ASG rules define permitted traffic, the order in which Cloud Foundry evaluates them does not matter. The system merges the rules, and blocks all traffic not explicitly allowed by an ASG.
  
  Under pre-Diego architecture, users could define `allow` or `deny` traffic rules at the VM level. These "Warden Server configuration rules" were evaluated after application security groups. Pivotal recommends configuring traffic rules solely using application security groups.
  
  ## <a id='viewing'></a>Viewing Application Security Groups ##
  
  Run the following commands to view information about existing application security groups:
  
  * `cf security-groups`: Displays all security groups in an org
  * `cf staging-security-groups`: Displays all security groups in the Default
  