anchor.diff:  * **Destination**: Destination of the traffic allowed by this rule as an IP address or CIDR block
   
   Run `cf create-security-group SECURITY-GROUP PATH-TO-RULES-FILE` from a command
  -line to create a security group named `SECURITY-GROUP`.
  +line to create an application security group named `SECURITY-GROUP`.
   `PATH-TO-RULES-FILE` can be an absolute or relative path to a rules file.
   The rules file must be a JSON-formatted single array containing objects that
   describe the rules.
  
positive.code: [{"protocol":"tcp","destination":"10.0.11.0/24","ports":"1-65535"},
  {"protocol":"udp","destination":"10.0.11.0/24","ports":"1-65535"}]
  ```
  ## <a id='binding-groups'></a>Binding Security Groups ##
  
  A security group consists of a list of rules.
  You must bind this list to either your entire deployment or to a space in an
  
negative.code: 
  Run `cf bind-security-group SECURITY-GROUP ORG SPACE` to bind a security group
  to a specific space.
  Cloud Foundry applies the rules that this ASG defines to all
  application containers in the space.
  A space may belong to more than one application security group.
  
  ## <a id='eval-sequence'></a>Rules Evaluation Sequence ##
  
  When multiple ASGs apply to a single container, any one of them can allow an outgoing message from its application. Because ASG rules define permitted traffic, the order in which Cloud Foundry evaluates them does not matter. The system merges the rules, and blocks all traffic not explicitly allowed by an ASG.
  
  Under pre-Diego architecture, users could define `allow` or `deny` traffic rules at the VM level. These "Warden Server configuration rules" were evaluated after application security groups. Pivotal recommends configuring traffic rules solely using application security groups.
  
  ## <a id='viewing'></a>Viewing Application Security Groups ##
  
  Run the following commands to view information about existing application security groups:
  
  * `cf security-groups`: Displays all security groups in an org
  * `cf staging-security-groups`: Displays all security groups in the Default
  