anchor.diff:  
   ### <a id='dns-example'></a>DNS ###
   
  -In order to resolve hostnames to IP addresses, apps require DNS server 
  +In order to resolve hostnames to IP addresses, applications require DNS server 
   connectivity, which typically use port 53. Administrators should create or
   update a `dns` ASG with appropriate rules. Administrators may further restrict
   the DNS servers to specific IP addresses or ranges of IP addresses.
  
positive.code: 
  <strong><%= modified_date %></strong>
  
  _This page assumes you are using [cf CLI](https://github.com/cloudfoundry/cli) v6.4 or higher._
  
  ## <a id='introduction'></a>Introduction ##
  
  This topic describes how to use and administer Application Security Groups (ASG). 
  
  ASGs are a collection of egress rules that specify the protocols, ports, and IP address ranges where application containers send outbound traffic. Because ASGs define *allow* rules, their order of evaluation is unimportant when multiple application security groups apply to the same space, org, or deployment. Application containers use these rules to filter and log outbound network traffic.
  
  When applications begin staging, they need traffic rules permissive enough to allow them to pull resources from the network. After an application is running, the traffic rules can be more restrictive and secure. To distinguish between these two security requirements, administrators can define one ASG for application staging, and another for runtime. 
  
  To provide granular control when securing a deployment, an administrator can also assign ASGs to apply across a deployment, or to specific spaces or orgs within a deployment.
  
  ASGs can be complicated to configure correctly, especially when the specific IPs listed in the group change.  To simplify securing a deployment while still letting apps reach external services, operators can deploy the services into a subnet that is separate from their Cloud Foundry deployment. Then the operators can create ASGs for the apps that whitelist those service subnets, while denying access to any VMs hosting other apps.
  
  For examples of typical ASGs, see the <a href="#typical-groups">Typical Application Security Groups</a> section of this topic.
  
  
negative.code: 
  ## <a id='updating-groups'></a>Updating Application Security Groups ##
  
  <p class='note'><strong>Note</strong>: Updating an ASG does not affect started applications until you restart them. To restart all of the applications in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  
  To update an existing ASG, run the following command, replacing `SECURITY-GROUP` with the name of your security group, and `PATH-TO-RULES-FILE` with the absolute or relative path to a rules file.
  <pre class="terminal">
  