_default_asg.html.md.erb

<%= vars.app_runtime_abbr %> defines one default ASG, `default_security_group`. This group allows all outbound traffic from app containers on public and private networks except for the link-local range, `169.254.0.0/16`, which is blocked.

<p class="note warning"><strong>Warning:</strong> For security, <%= vars.app_runtime_abbr %> admins must modify the default ASGs so that outbound network traffic cannot access internal components. For more information, see <a href="../opsguide/app-sec-groups.html">Restricting App Access to Internal <%= vars.platform_name %> Components</a>.</p>

The ASG is defined in the Cloud Controller configuration as follows:

```
security_group_definitions:
- name: default_security_group
  rules:
  - protocol: all
    destination: 0.0.0.0-169.253.255.255
  - protocol: all
    destination: 169.255.0.0-255.255.255.255
```