anchor.diff:    }
   ]
   ```
  +
   ### <a id='marketplace-services'></a>Marketplace Services ###
   
   Each installed Marketplace Service requires its own set of ASG rules to
  
positive.code: |Attribute        |Description                                                                                                                                                                                                  |Notes
  |---              |---                                                                                                                                                                                                          |---
  |`protocol`       |`tcp`, `udp`, `icmp`, or `all`                                                                                                                                                                               |Required
  |`destination`    |A single IP address, an IP address range like `192.0.2.0-192.0.1-4`, or a CIDR block to allow network access to.
  |`ports`          |A single port, multiple comma-separated ports, or a single range of ports that can receive traffic. Examples: `443`, `80,8080,8081`, `8080-8081`.                                                            |Required when `protocol` is `tcp` or `udp`
  |`code`           |ICMP code                                                                                                                                                                                                    |Required when `protocol` is `icmp`
  |`type`           |ICMP type                                                                                                                                                                                                    |Required when `protocol` is `icmp`
  |`log`            |Set to `true` to enable logging. For more information about how to configure system logs to be sent to a syslog drain, see the <a href="../devguide/services/log-management.html">Using Log Management Services</a> topic.
  | `description`   |An optional text field for operators managing security group rules.
  
  ##<a id="process"></a> Process for Administering ASGs
  
  
negative.code: 
  ## <a id='introduction'></a>Introduction ##
  
  This topic provides an overview of Application Security Groups (ASGs) and describes how to manage and administer them. 
  
  ###<a id="defn"></a>Application Security Groups
  
  Application Security Groups (ASGs) are a collections of egress rules that 
  specify the protocols, ports, and IP address ranges where app or task 
  containers send traffic. 
  Because ASGs define *allow* rules, their order of evaluation is unimportant 
  when multiple ASGs apply to the same space or deployment. 
  Containers use these rules to filter and log outbound network traffic. 
  ASGs apply to both buildpack-based and Docker-based containers in both the app 
  and task lifecycle phases.
  
  When apps or tasks begin staging, they need traffic rules permissive enough to 
  allow them to pull resources from the network. 
  After an app or task is running, the traffic rules can be more restrictive and 
  secure. 
  To distinguish between these two security requirements, administrators can 
  define one ASG for app and task staging, and another for app and task runtime. 
  
  To provide granular control when securing a deployment, an administrator can 
  assign ASGs to apply to all containers across a deployment, or to specific 
  spaces within a deployment.
  
  ASGs can be complicated to configure correctly, especially when the specific IP 
  addresses listed in a group change. 
  To simplify securing a deployment while still permitting apps reach external 
  services, operators can deploy the services into a subnet that is separate from 
  their Cloud Foundry deployment. 
  Then the operators can create ASGs for the apps that whitelist those service 
  subnets, while denying access to any virtual machine (VM) hosting other apps.
  
  For examples of typical ASGs, see the <a href="#typical-groups">Typical Application Security Groups</a> section of this topic.
  
  