anchor.diff:       }
   </style>
   
  -This topic describes how to secure the component VMs of your Pivotal Cloud Foundry (PCF) deployment from being accessed by apps.
  -
  -## <a id='overview'></a> Overview ##
  -
  -By default, app containers running on PCF can send traffic to any IP address, including the component VMs that make up PCF. To help secure your component VMs against apps, Elastic Runtime provides _Application Security Groups (ASGs)_. ASGs are rules that specify the protocols, ports, and IP address ranges where app containers can send traffic. Pivotal recommends creating ASGs as outlined in the procedure below.
  -
  - For more information, see [Understanding ASGs](../concepts/asg.html).
  -
  -
  -## <a id='prerequisites'></a> Prerequisite ##
  -
  -This procedure requires that you have the latest release of [ASG Creator](https://github.com/cloudfoundry-incubator/asg-creator/releases/latest) from the Cloud Foundry incubator repository on Github.
  -
  -## <a id='network'></a> Step 1: Determine your Network Layout ##
  +This topic describes how to secure the component VMs of your Pivotal Cloud Foundry (PCF) deployment from being accessed by apps. 
  +
  +## <a id='overview'></a> Introduction ##
  +
  +See the following list to understand the concepts for this topic:
  +
  +* **How PCF determines where apps can send traffic**: 
  +  * PCF uses _Application Security Groups (ASGs)_, which are rules that specify the protocols, ports, and IP addresses that apps can send traffic to. See [Understanding ASGs](../concepts/asg.html).
  +* **Why you must create new rules for outbound app traffic**: 
  +  * PCF installs with a [default ASG](./concepts/asg.html#default-asg) that allows apps running on your deployment to send traffic to any IP address, which means internal PCF components are vulnerable to untrusted code.
  +* **How you can set up new rules**: 
  +  * To help secure your component VMs against apps while ensuring your apps can access the services they need, follow the [procedure](#procedure) below, which includes these steps:
  +    <table>
  +    <tr>
  +    <th>Step</th>
  +    <th>Description</th>
  +    </tr>
  +    <tr>
  +      <td>1</td>
  +      <td><a href="network">Determine Your Network Layout</a>: <br>The procedure for securing your deployment with ASGs varies depending on your network layout, which you can determine using Ops Manager.</td>
  +    </tr>
  +    <tr>
  +      <td>2</td>
  +      <td><a href="bind-default">Ensure Access for PCF System Apps</a>: <br>Bind the default ASG to the <code>system</code> org so that PCF system apps can continue accessing the system components they need after you remove the  deployment-wide default ASG in Step 4.</td>
  +    </tr>
  +    <tr>
  +      <td>3</td>
  +      <td><a href="initial">Create New ASGs</a>: <br>Block apps from sending traffic to system components, but allow them to send traffic to the services they need.</td>
  +    </tr>
  +    <tr>
  +      <td>4</td>
  +      <td><a href="unbind-default">Remove the Default ASG</a>: <br>After you create and bind new ASGs, you no longer need the deployment-wide default ASG bindings that allow apps to send traffic to any IP.</td>
  +    </tr>
  +    <tr>
  +      <td>5</td>
  +      <td><a href="restart">Restart your Apps</a>: <br>To apply the ASG changes, you must restart all of the apps in your deployment.</td>
  +    </tr>
  +    </table>
  +
  +## <a id='prerequisites'></a> Prerequisites ##
  +
  +The procedure below requires that you have the latest release of [ASG Creator](https://github.com/cloudfoundry-incubator/asg-creator/releases/latest) from the Cloud Foundry incubator repository on Github. See [About the ASG Creator Tool](../concepts/asg.html#asg-baseline)
  +
  +
  +## <a id='procedure'></a> Procedure
  +
  +Follow these steps to apply ASGs that prevent apps running on your deployment from accessing internal PCF components. 
  +
  +### <a name='network'></a> Step 1: Determine Your Network Layout ##
   
   The procedure for securing your deployment with ASGs varies depending on your network layout, which you can determine by following these steps: 
   
  
positive.code: 
  1. Record the **CIDR** for each network.
  
  ### <a id='initial-asgs'></a> Part B: Create and Bind ASGs for your Network Layout
  
  Create ASGs that block apps from sending traffic to the networks that host Ops Manager, Elastic Runtime, and any services installed. 
  
  1. Create a `config.yml` containing the appropriate content for your network layout and replace the indicated values with the CIDRs you gathered:
    * **Two Network Layout**:
  
negative.code:     </tr>
    </table>
  
  1. If your network layout includes two or more networks, continue [Step 2: Enxure Access for PCF System Apps](#bind-default).
  
  ### <a name='bind-default'></a> Step 2: Ensure Access for PCF System Apps ##
  
  Follow these steps to apply the default ASG to the `system` org. This provides network access to PCF system apps without restrictions, which enables them to continue functioning properly after you perform [Step 4: Remove the Deployment-wide Default ASG Binding](#unbind-default).
  
  1. Bind the default ASG to the [staging set](../concepts.html/asg.html#asg-sets) in the `system` org:
      <pre class="terminal">$ cf bind-staging-security-group default\_security\_group system</pre>
  
  1. Bind the default ASG to the [running set](../concepts.html/asg.html#asg-sets) in the `system` org:
      <pre class="terminal">$ cf bind-running-security-group default\_security\_group system</pre>
  
  ### <a name='initial'></a> Step 3: Create New ASGs ##
  
  Follow these steps to create ASGs that block apps from accessing PCF components and create any additional ASGs that allow apps to access the services they require. 
  
  #### <a name='get-cidrs'></a> Part A: Record CIDRs
  
  Gather the CIDRs for each network in your deployment:
  
  