anchor.diff:  ## <a id='procedures'></a> Managing ASGs with the cf CLI
   
   This section provides the commands you need to create and manage ASGs.
  +
  +<%= vars.mutual_tls_tcp %>
   
   ### <a id='viewing'></a> View ASGs
   
  
positive.code: 
  ### <a id='dns-example'></a> DNS
  
  To resolve hostnames to IP addresses, apps require DNS server connectivity, 
  which typically use port 53. 
  Administrators should create or update a `dns` ASG with appropriate rules. Administrators may further restrict the DNS servers to specific IP addresses or 
  ranges of IP addresses.
  
  Example `dns` ASG:
  
negative.code:   </tr>
  </table>
  
  Typically, ASGs applied during the staging lifecycle are more permissive than
  the ASGs applied during the running lifecycle.
  This is because staging often requires access to different resources, such as
  dependencies.
  
  You use different commands to apply an ASG to each of the four sets. For more information, see the [Procedures](#procedures) section of this topic.
  
  <p class="note"><strong>Note</strong>: To apply a staging ASG to apps within a space, you must use cf CLI v6.28.0 or later.
  </p>
  
  ### <a id='creating-groups'></a> The Structure and Attributes of ASGs
  
  ASG rules are specified as a JSON array of ASG objects. An ASG object has the following attributes:
  
  
  |Attribute        |Description                                                                                                                                                                                                  |Notes
  |---              |---                                                                                                                                                                                                          |---
  |`protocol`       |`tcp`, `udp`, `icmp`, or `all`                                                                                                                                                                               |Required
  |`destination`    |A single IP address, an IP address range like `192.0.2.0-192.0.2.50`, or a CIDR block that can receive traffic
  |`ports`          |A single port, multiple comma-separated ports, or a single range of ports that can receive traffic. Examples: `443`, `80,8080,8081`, `8080-8081`                                                            |Required when `protocol` is `tcp` or `udp`
  |`code`           |ICMP code                                                                                                                                                                                                    |Required when `protocol` is `icmp`. A value of `-1` allows all codes.
  