anchor.diff:      ]
       </pre>
   
  -1. Run `cf create-security-group SECURITY-GROUP PATH-TO-RULES-FILE`. Replace `SECURITY-GROUP` with the name of your security group, and `PATH-TO-RULES-FILE`
  -with the absolute or relative path to a rules file.
  +1. Run `cf create-security-group SECURITY-GROUP PATH-TO-RULES-FILE`. Replace `SECURITY-GROUP` with the name of your security group, and `PATH-TO-RULES-FILE` with the absolute or relative path to a rules file.
   
   In the following example, `my-asg` is the name of a security group, and `~/workspace/my-asg.json` is the path to a rules file.
   
  
positive.code: 
  ### <a id='dns-example'></a> DNS
  
  To resolve hostnames to IP addresses, apps require DNS server connectivity,
  which typically use port 53.
  Administrators should create or update a `dns` ASG with appropriate rules. Administrators can further restrict the DNS servers to specific IP addresses or
  ranges of IP addresses.
  
  Example `dns` ASG:
  
  
negative.code: $ cf create-security-group my-asg ~/workspace/my-asg.json
  </pre>
  
  After the ASG is created, you must bind it to an ASG set before it takes effect. See <a href="#binding-groups">Bind ASGs</a> below.
  
  ### <a id='binding-groups'></a> Bind ASGs
  
  <p class='note'><strong>Note:</strong> Binding an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.
  </p>
  
  To apply an ASG, you must first bind it to an ASG set.
  