anchor.diff:          "protocol": "tcp",
           "destination": "10.0.11.0/24",
           "ports": "80-443",
  -        "log": true,
  -        "description": "Allow http and https traffic from ZoneA"
  +        "log": true<%= vars.appsecgroupdesc1 %> 
         }
       ]
  -    ```
  +    </pre>
   
   1. Run the following cf CLI command, replacing `SECURITY-GROUP` with the name of your security group and `PATH-TO-RULES-FILE` with the absolute or relative path to a rules file.
   <pre class="terminal">
  
positive.code: code 1 and type 0 to all destinations, and TCP traffic to 10.0.11.0/24 on ports
  80-443:
  
      ```
      [
        {
          "protocol": "icmp",
  
negative.code: |`code`           |ICMP code                                                                                                                                                                                                    |Required when `protocol` is `icmp`
  |`type`           |ICMP type                                                                                                                                                                                                    |Required when `protocol` is `icmp`
  |`log`            |Set to `true` to enable logging. For more information on how to configure system logs to be sent to a syslog drain see <a href="../devguide/services/log-management.html">Using Log Management Services</a>
  <%= vars.app_sec_group_desc %>
  
  Follow the instructions in the sections below to create [individual ASGs](#asg-individual) and [baseline ASGs](#asg-baseline).
  
  