anchor.diff:  
   ## <a id="asg-sets"></a> ASG Sets ##
   
  -An ASG set is a collection of ASGs that an administrator can apply to application containers. 
  -
  -### <a id="default-set"></a> Default ASG Sets ###
  -
  -All application containers in <%= vars.product_full %> use a default ASG set as a base policy.
  -
  -<%= vars.product_full %> provides two default ASG sets:
  -
  -* `default-staging`: This ASG set applies to application containers that are in the
  -staging application lifecycle phase. This includes both the buildpack staging
  -and Docker staging process. Typically, ASGs applied to staging application containers are more permissive to allow access to resources required for build and staging processes.
  -* `default-running`: This ASG set applies to application containers that are
  -started and running apps or tasks. Typically, ASGs applied to containers running apps and tasks are more restrictive.
  -
  -### <a id="space-scoped"></a> Space-Scoped ASG Sets ###
  -
  -In addition to the `default-staging` and `default-running` ASG sets, administrators can define additional ASGs and bind them to <%= vars.product_full %> [spaces](../concepts/roles.html#spaces). These ASGs are scoped to the space and are applied as a set to all application containers, either running or staging, in that space.
  -
  -ASGs bound to spaces add network access only to the application containers within that space. 
  -
  -In addition, space-scoped ASGs also apply to either staging tasks or running tasks.
  -
  -Currently, <%= vars.product_full %> supports the use of space-scoped ASGs for staging application containers, however this is only supported via the CC API and not yet supported by the cf CLI. 
  -
  -To apply staging-level network access to space-scoped ASGs, use the following CloudController (CC) API commands:
  -
  -<pre>
  -GET /v2/security_groups/:guid/staging_spaces
  -PUT /v2/spaces/:guid/staging_security_groups/:security_group_guid data
  -PUT /v2/security_groups/:guid/staging_spaces/:space_guid
  -DELETE /v2/spaces/:guid/staging_security_groups/:security_group_guid  data
  -DELETE /v2/security_groups/:guid/staging_spaces/:space_guid
  -</pre>
  -
  -These API calls require administrator access. 
  -
  -Additionally, the payload returned from API `GET` calls to
  -`/v2/spaces/` and `/v2/spaces/:guid` includes a link to the 
  -`staging_security_groups_url`.
  -
  -For more information on using these CC API commands, see the [Cloud Foundry API](https://apidocs.cloudfoundry.org/) documentation.
  -
  -### <a id="asg-sets-applied"></a>How ASG Sets Are Applied ###
  -
  -When <%= vars.product_full %> creates an application container, the egress rules for the application container include the following:
  -
  -* All ASGs in either the `default-staging` or `default-running` set, depending on the staging or running state of LRP or task
  -* All ASGs bound to the space associated with the LRP or task, depending on the staging or running state of the LRP or task
  -
  -## <a id='viewing'></a>Viewing ASGs ##
  +There are four ASG sets in Cloud Foundry:
  +
  ++ Platform-wide staging ASG set
  ++ Platform-wide running ASG set
  ++ Space-scoped staging ASG set
  ++ Space-scoped running ASG set
  +
  +The following table indicates the differences among the four sets.
  +
  +<table>
  +  <tr>
  +    <th>When an ASG is bound to the... </th>
  +    <th>the ASG rules are applied to...</th>
  +    <th>that are... </th>
  +  </tr>
  +  <tr>
  +    <td>Platform-wide staging ASG set</td>
  +    <td>all containers</td>
  +    <td>staging source code for apps and task during the staging lifecycle phase.
  +</td>
  +  </tr>
  +  <tr>
  +    <td>Platform-wide running ASG set</td>
  +    <td>all containers</td>
  +    <td>running apps or tasks.</td>
  +  </tr>
  +  <tr>
  +    <td>Space-scoped staging ASG set</td>
  +    <td>containers in one space</td>
  +    <td>staging source code for apps and task during the staging lifecycle phase.</td>
  +  </tr>
  +  <tr>
  +    <td>Space-scoped running ASG set</td>
  +    <td>containers in one space</td>
  +    <td>running apps or tasks.</td>
  +  </tr>
  +</table>
  +
  +Typically, ASGs applied to staging containers are more permissive than the ASGs applied to running containers. 
  +This is because staging often requires access to different resources, such as dependencies.
  +
  +You need to use different commands to apply an ASG to each of the four sets. See below.
  + 
  +<p class="note"><strong>Note</strong>: Currently, Cloud Foundry supports the use of space-scoped ASGs 
  +for staging application containers only through the CC API. 
  +Application of ASGs to staging containers in a single org is not yet supported by the cf CLI. 
  + </p>
  +
  +## <a id='viewing'></a>View ASGs ##
   
   Run the following commands to view information about existing ASGs:
   
  
positive.code: ## <a id='introduction'></a>Introduction ##
  
  This topic describes how to use and administer Application Security Groups 
  (ASG)s.
  
  ASGs are a collection of egress rules that specify the protocols, ports, and IP address ranges where application containers (for either LRPs or tasks) send outbound traffic. Because ASGs define *allow* rules, their order of evaluation is unimportant when multiple ASGs apply to the same space, org, or deployment. Application containers use these rules to filter and log outbound network traffic.
  
  
negative.code: Each installed Marketplace Service requires its own set of ASG rules to
  function properly. Refer to the installation instructions for each
  installed Marketplace Service to determine which ASG rules it requires. See the [Services Overview](../devguide/services/) topic for more information about how to provision and integrate services.
  
  ##<a id='asg-baseline'></a> About the ASG Creator Tool
  
  The ASG Creator is a command line tool that you can use to create JSON rules files. 
  The ASG Creator lets you specify IP addresses, CIDRs, and IP address ranges that you want to _disallow_ traffic to,
  as well as the addresses that you to _allow_ traffic to. 
  Based on these disallow/allow (exclude/include) lists that you provide as input, 
  the ASG Creator formulates a JSON file of allow rules. 
  
  In turn, the JSON file is the input for the `cf bind-security-group ` command that creates an ASG.  
  
  You can download the latest release of the ASG Creator from the Cloud Foundry incubator repository on Github, 
  [here](https://github.com/cloudfoundry-incubator/asg-creator/releases/latest).
  