anchor.diff:  ---
  -title: Securing your Deployment with Application Security Groups
  +title: Restricting App Access to Internal PCF Components
   owner: Security
   ---
   
  -## <a id='prerequisites'></a> Prerequisites ##
  +<style>
  +    .note.warning {
  +        background-color: #fdd;
  +        border-color: #fbb
  +    }
   
  -* Download the latest release of the [ASG Creator](https://github.com/cloudfoundry-incubator/asg-creator/releases/latest) from the Cloud Foundry incubator repository on Github.
  +    .note.warning:before {
  +        color: #f99;
  +     }
  +</style>
   
  -## <a id='bind-default'></a> Step 1: Bind the Default ASG ##
  +This topic describes how to secure the component VMs of your Pivotal Cloud Foundry (PCF) deployment from being accessed by apps.
   
  -The default ASG's name is either `all_open` or `default_security_group`. The name of the ASG depends on the version of your initial Elastic Runtime installation.
  +## <a id='overview'></a> Overview ##
   
  -1. Run the following commands:
  -  <pre class="terminal">
  -  $ cf running-security-groups
  -  </pre>
  -  
  -1. Examine the output to determine which default ASG you have: `all_open` or `default_security_group`. 
  +By default, app containers running on PCF can send traffic to any IP address, including the component VMs that make up PCF. To help secure your component VMs against apps, Elastic Runtime provides _Application Security Groups (ASGs)_. ASGs are rules that specify the protocols, ports, and IP address ranges where app containers can send traffic. Pivotal recommends creating ASGs as outlined in the procedure below.
   
  -1. Bind the default security group to the staging set:
  -  * If `all_open`, run the following:
  -    <pre class="terminal">$ cf bind-staging-security-group all_open system</pre>
  -  * If `default_security_group`, run the following:
  -    <pre class="terminal">$ cf bind-staging-security-group default_security_group system</pre>
  -
  -1. Bind the default security group to the running set:
  -  * If `all_open`, run the following:
  -    <pre class="terminal">$ cf bind-running-security-group all_open system</pre>
  -  * If `default_security_group`, run the following:
  -    <pre class="terminal">$ cf bind-running-security-group default_security_group system</pre>
  + For more information, see [Understanding ASGs](../concepts/asg.html).
   
   
  -## <a id='network'></a> Step: 2 Determine your Network Layout ##
  +## <a id='prerequisites'></a> Prerequisite ##
   
  -The steps for securing your deployment with ASGs vary depending on your network layout. Follow this procedure to determine your network layout. 
  +This procedure requires that you have the latest release of [ASG Creator](https://github.com/cloudfoundry-incubator/asg-creator/releases/latest) from the Cloud Foundry incubator repository on Github.
  +
  +## <a id='network'></a> Step 1: Determine your Network Layout ##
  +
  +The procedure for securing your deployment with ASGs varies depending on your network layout, which you can determine by following these steps: 
   
   1. Log in to Ops Manager. 
   
  -1. For each tile, click **Assign AZs and Networks** and record the selected **Network** the tile is installed on. 
  +1. For each tile, click **Assign AZs and Networks** and record the selected **Network** that the tile is installed on. 
   
   1. Based on the information you gathered, determine which of the following network layouts you have:
     <table>
  
positive.code:     </tr>
    </table>
  
  ## <a id='initial'></a> Step 3: Create Initial ASGs ##
  
  Gather the CIDRs for each of the networks in your deployment.
  
  1. From the Ops Manager Director tile, click **Create Networks** within the **Settings** tab.
  
  
negative.code:     </tr>
      <tr>
        <td>One Network</td>
        <td><ul><li>One network for Ops Manager and the Ops Manager Director, Elastic Runtime, and services.</li></ul>
        <p class="note"><strong>Note</strong>: If you have the <em>One Network</em> layout, you cannot secure your deployment with ASGs. The IPs of PCF component VMs and Service VMs are defined as a range in the BOSH manifest, and because of the way BOSH allocates IP addresses, you cannot know where in that range the IP of the service you want to provide access to will live.</p>  
        </td>
      </tr>
      <tr>
        <td>Two Networks</td>
  