ASA - object group protocol vs service

When configuring an object-group on a Cisco ASA, it is possible to define it based on several parameters including protocol and service.

These two options are similar.

The protocol option allows you to define a group of protocols. The options provided can be seen below:

myASA(config)# object-group protocol PROTOCOLGROUP
myASA(config-protocol-object-group)# ?

  description      Specify description text
  group-object     Configure an object group as an object
  help             Help for protocol object-group configuration commands
  no               Remove an object or description from object-group
  protocol-object  Configure a protocol object

myASA(config-protocol-object-group)# protocol-object ?

protocol-object-group mode commands/options:
  <0-255>  Enter protocol number (0 - 255)
  ah
  eigrp
  esp
  gre
  icmp
  icmp6
  igmp
  igrp
  ip
  ipinip
  ipsec
  nos
  ospf
  pcp
  pim
  pptp
  sctp
  snp
  tcp
  udp
myASA(config-protocol-object-group)# protocol-object

You can see protocol groups include various mechanisms including icmp, gre, eigrp, ipsec, ip, and so on.

Now if you use the service option, you can define a mixed group of services.

myASA(config)# object-group service SERVICEGROUP
myASA(config-service-object-group)# ?

  description     Specify description text
  group-object    Configure an object group as an object
  help            Help for service object-group configuration commands
  no              Remove an object or description from object-group
  service-object  Configure a service object
myASA(config-service-object-group)# service-object ?

dual-service-object-group mode commands/options:
  <0-255>  Enter protocol number (0 - 255)
  ah
  eigrp
  esp
  gre
  icmp
  icmp6
  igmp
  igrp
  ip
  ipinip
  ipsec
  nos
  object   Enter this keyword to specify a service object
  ospf
  pcp
  pim
  pptp
  sctp
  snp
  tcp
  tcp-udp  Both TCP & UDP
  udp
myASA(config-service-object-group)# service-object

Above you can see many of the same options, however, the service keyword is somewhat more powerful than the protocol keyword.

Indeed Cisco recommends you use the service option rather than the protocol option.

Links:

https://forum.networklessons.com/t/cisco-asa-object-group-for-access-list/822/28?u=lagapides

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/I-R/asa-command-ref-I-R/o-commands.html#wp4279334402