ASA - object group protocol vs service

When configuring an object-group on a Cisco ASA, it is possible to define it based on several parameters including protocol and service.

These two options are similar.

The protocol option allows you to define a group of protocols. The options provided can be seen below:

myASA(config)# object-group protocol PROTOCOLGROUP
myASA(config-protocol-object-group)# ?

  description      Specify description text
  group-object     Configure an object group as an object
  help             Help for protocol object-group configuration commands
  no               Remove an object or description from object-group
  protocol-object  Configure a protocol object

myASA(config-protocol-object-group)# protocol-object ?

protocol-object-group mode commands/options:
  <0-255>  Enter protocol number (0 - 255)
  ah
  eigrp
  esp
  gre
  icmp
  icmp6
  igmp
  igrp
  ip
  ipinip
  ipsec
  nos
  ospf
  pcp
  pim
  pptp
  sctp
  snp
  tcp
  udp
myASA(config-protocol-object-group)# protocol-object

You can see protocol groups include various mechanisms including icmp, gre, eigrp, ipsec, ip, and so on.

Now if you use the service option, you can define a mixed group of services.

myASA(config)# object-group service SERVICEGROUP
myASA(config-service-object-group)# ?

  description     Specify description text
  group-object    Configure an object group as an object
  help            Help for service object-group configuration commands
  no              Remove an object or description from object-group
  service-object  Configure a service object
myASA(config-service-object-group)# service-object ?

dual-service-object-group mode commands/options:
  <0-255>  Enter protocol number (0 - 255)
  ah
  eigrp
  esp
  gre
  icmp
  icmp6
  igmp
  igrp
  ip
  ipinip
  ipsec
  nos
  object   Enter this keyword to specify a service object
  ospf
  pcp
  pim
  pptp
  sctp
  snp
  tcp
  tcp-udp  Both TCP & UDP
  udp
myASA(config-service-object-group)# service-object

Above you can see many of the same options, however, the service keyword is somewhat more powerful than the protocol keyword.

https://forum.networklessons.com/t/cisco-asa-object-group-for-access-list/822/28?u=lagapides