diff --git a/specification/network/resource-manager/Microsoft.Network/2017-08-01/applicationSecurityGroup.json b/specification/network/resource-manager/Microsoft.Network/2017-08-01/applicationSecurityGroup.json
new file mode 100644
index 000000000000..53b6f6e99e5c
--- /dev/null
+++ b/specification/network/resource-manager/Microsoft.Network/2017-08-01/applicationSecurityGroup.json
@@ -0,0 +1,282 @@
+{
+  "swagger": "2.0",
+  "info": {
+    "title": "NetworkManagementClient",
+    "description": "The Microsoft Azure Network management API provides a RESTful set of web services that interact with Microsoft Azure Networks service to manage your network resources. The API has entities that capture the relationship between an end user and the Microsoft Azure Networks service.",
+    "version": "2017-06-01"
+  },
+  "host": "management.azure.com",
+  "schemes": [
+    "https"
+  ],
+  "consumes": [
+    "application/json",
+    "text/json"
+  ],
+  "produces": [
+    "application/json",
+    "text/json"
+  ],
+  "security": [
+    {
+      "azure_auth": [
+        "user_impersonation"
+      ]
+    }
+  ],
+  "securityDefinitions": {
+    "azure_auth": {
+      "type": "oauth2",
+      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
+      "flow": "implicit",
+      "description": "Azure Active Directory OAuth2 Flow",
+      "scopes": {
+        "user_impersonation": "impersonate your user account"
+      }
+    }
+  },
+  "paths": {
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/applicationSecurityGroups/{applicationSecurityGroupName}": {
+      "delete": {
+        "tags": [
+          "ApplicationSecurityGroups"
+        ],
+        "operationId": "ApplicationSecurityGroups_Delete",
+        "description": "Deletes the specified application security group.",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ResourceGroupNameParameter"
+          },
+          {
+            "$ref": "#/parameters/ApplicationSecurityGroupNameParameter"
+          },
+          {
+            "$ref": "./network.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "./network.json#/parameters/SubscriptionIdParameter"
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Request successful. Resource does not exist."
+          },
+          "202": {
+            "description": "Accepted and the operation will complete asynchronously."
+          },
+          "200": {
+            "description": "Delete successful."
+          }
+        },
+        "x-ms-long-running-operation": true
+      },
+      "get": {
+        "tags": [
+          "ApplicationSecurityGroups"
+        ],
+        "operationId": "ApplicationSecurityGroups_Get",
+        "description": "Gets information about the specified application security group.",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ResourceGroupNameParameter"
+          },
+          {
+            "$ref": "#/parameters/ApplicationSecurityGroupNameParameter"
+          },
+          {
+            "$ref": "./network.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "./network.json#/parameters/SubscriptionIdParameter"
+          },
+          {
+            "name": "$expand",
+            "in": "query",
+            "required": false,
+            "type": "string",
+            "description": "Expands referenced resources."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Request successful. The operation returns the specified application security group resource.",
+            "schema": {
+              "$ref": "#/definitions/ApplicationSecurityGroup"
+            }
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "ApplicationSecurityGroups"
+        ],
+        "operationId": "ApplicationSecurityGroups_CreateOrUpdate",
+        "description": "Creates or updates an application security group.",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ResourceGroupNameParameter"
+          },
+          {
+            "$ref": "#/parameters/ApplicationSecurityGroupNameParameter"
+          },
+          {
+            "name": "parameters",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/ApplicationSecurityGroup"
+            },
+            "description": "Parameters supplied to the create or update ApplicationSecurityGroup operation."
+          },
+          {
+            "$ref": "./network.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "./network.json#/parameters/SubscriptionIdParameter"
+          }
+        ],
+        "responses": {
+          "201": {
+            "description": "Create successful. The operation returns the resulting application security group resource.",
+            "schema": {
+              "$ref": "#/definitions/ApplicationSecurityGroup"
+            }
+          },
+          "200": {
+            "description": "Update successful. The operation returns the resulting application security group resource.",
+            "schema": {
+              "$ref": "#/definitions/ApplicationSecurityGroup"
+            }
+          }
+        },
+        "x-ms-long-running-operation": true
+      }
+    },
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/applicationSecurityGroups/{applicationSecurityGroupName}/ipConfigurations": {
+      "get": {
+        "tags": [
+          "ApplicationSecurityGroups"
+        ],
+        "operationId": "ApplicationSecurityGroups_GetIpConfigurations",
+        "description": "This operation returns the IP configurations that reference the specified application security group resource.",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ResourceGroupNameParameter"
+          },
+          {
+            "$ref": "#/parameters/ApplicationSecurityGroupNameParameter"
+          },
+          {
+            "$ref": "./network.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "./network.json#/parameters/SubscriptionIdParameter"
+          },
+          {
+            "name": "$expand",
+            "in": "query",
+            "required": false,
+            "type": "string",
+            "description": "Expands referenced resources."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Request successful. The operation returns the IP configurations that reference the specified application security group resource.",
+            "schema": {
+              "$ref": "./networkInterface.json#/definitions/NetworkInterfaceIPConfigurationListResult"
+            }
+          }
+        }
+      }
+    },
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/applicationSecurityGroups/{applicationSecurityGroupName}/securityRules": {
+      "get": {
+        "tags": [
+          "ApplicationSecurityGroups"
+        ],
+        "operationId": "ApplicationSecurityGroups_GetSecurityRules",
+        "description": "This operation returns the security rules that reference the specified application security group resource.",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ResourceGroupNameParameter"
+          },
+          {
+            "$ref": "#/parameters/ApplicationSecurityGroupNameParameter"
+          },
+          {
+            "$ref": "./network.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "./network.json#/parameters/SubscriptionIdParameter"
+          },
+          {
+            "name": "$expand",
+            "in": "query",
+            "required": false,
+            "type": "string",
+            "description": "Expands referenced resources."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Request successful. The operation returns the security rules that reference the specified application security group resource.",
+            "schema": {
+              "$ref": "./networkSecurityGroup.json#/definitions/SecurityRuleListResult"
+            }
+          }
+        }
+      }
+    }
+  },
+  "definitions": {
+    "ApplicationSecurityGroup": {
+      "properties": {
+        "properties": {
+          "x-ms-client-flatten": true,
+          "$ref": "#/definitions/ApplicationSecurityGroupPropertiesFormat",
+          "description": "Properties of the application security group."
+        },
+        "etag": {
+          "type": "string",
+          "description": "A unique read-only string that changes whenever the resource is updated."
+        }
+      },
+      "allOf": [
+        {
+          "$ref": "./network.json#/definitions/Resource"
+        }
+      ],
+      "description": "An application security group in a resource group."
+    },
+    "ApplicationSecurityGroupPropertiesFormat": {
+      "properties": {
+        "resourceGuid": {
+          "type": "string",
+          "description": "The resource GUID property of the application security group resource."
+        },
+        "provisioningState": {
+          "type": "string",
+          "description": "The provisioning state of the application security group resource. Possible values are: 'Updating', 'Deleting', and 'Failed'."
+        }
+      },
+      "description": "Application security group properties."
+    }
+  },
+  "parameters": {
+    "ResourceGroupNameParameter": {
+      "name": "resourceGroupName",
+      "in": "path",
+      "required": true,
+      "type": "string",
+      "description": "The name of the resource group."
+    },
+    "ApplicationSecurityGroupNameParameter": {
+      "name": "applicationSecurityGroupName",
+      "in": "path",
+      "required": true,
+      "type": "string",
+      "description": "The name of the application security group."
+    }
+  }
+}
diff --git a/specification/network/resource-manager/Microsoft.Network/2017-08-01/networkInterface.json b/specification/network/resource-manager/Microsoft.Network/2017-08-01/networkInterface.json
index 1ff392137cbd..537b304b0e8d 100644
--- a/specification/network/resource-manager/Microsoft.Network/2017-08-01/networkInterface.json
+++ b/specification/network/resource-manager/Microsoft.Network/2017-08-01/networkInterface.json
@@ -550,6 +550,13 @@
           "$ref": "./publicIpAddress.json#/definitions/PublicIPAddress",
           "description": "Public IP address bound to the IP configuration."
         },
+        "associatedApplicationSecurityGroups": {
+          "type": "array",
+          "items": {
+            "$ref": "./applicationSecurityGroup.json#/definitions/ApplicationSecurityGroup"
+          },
+          "description": "List of application security groups in which the IP configuration is included."
+        },
         "provisioningState": {
           "type": "string",
           "description": "The provisioning state of the network interface IP configuration. Possible values are: 'Updating', 'Deleting', and 'Failed'."
diff --git a/specification/network/resource-manager/Microsoft.Network/2017-08-01/networkSecurityGroup.json b/specification/network/resource-manager/Microsoft.Network/2017-08-01/networkSecurityGroup.json
index 9405e55a562f..f9898a3e7825 100644
--- a/specification/network/resource-manager/Microsoft.Network/2017-08-01/networkSecurityGroup.json
+++ b/specification/network/resource-manager/Microsoft.Network/2017-08-01/networkSecurityGroup.json
@@ -597,6 +597,10 @@
           },
           "description": "The CIDR or source IP ranges."
         },
+        "sourceApplicationSecurityGroup": {
+          "$ref": "./applicationSecurityGroup.json#/definitions/ApplicationSecurityGroup",
+          "description": "Application security group specified as source."
+        },
         "destinationAddressPrefix": {
           "type": "string",
           "description": "The destination address prefix. CIDR or destination IP range. Asterix '*' can also be used to match all source IPs. Default tags such as 'VirtualNetwork', 'AzureLoadBalancer' and 'Internet' can also be used."
@@ -608,6 +612,10 @@
           },
           "description": "The destination address prefixes. CIDR or destination IP ranges."
         },
+        "destinationApplicationSecurityGroup": {
+          "$ref": "./applicationSecurityGroup.json#/definitions/ApplicationSecurityGroup",
+          "description": "Application security group specified as destination."
+        },
         "sourcePortRanges": {
           "type": "array",
           "items": {