Skip to main content



Cisco Defense Orchestrator

Service Objects

ASA Service Objects

ASA service objects, service groups, and port groups are reusable components that contain protocols or ports considered part of the TCP/IP protocol suite. In a service object you can specify a single protocol and assign it to a source port, destination port, or both source and destination ports. A service group contains many service objects and can include a mix of protocols.

A port group is a kind of ASA service object. Port groups contain port objects pair a service type, such as tcp or udp, and a port number of a range of port numbers but you cannot assign the port object to a source or desinationport. You can then use the objects in security policies for purposes of defining traffic matching criteria, for example, to use access rules to allow traffic to specific TCP ports.

Protocol Objects

Protocol objects are a type of service object that contain less-commonly used or legacy protocols. Protocol objects are identified by a name and protocol number. CDO recognizes these objects in ASA configurations and gives them their own filter of "Protocols" so you can find them easily. 

ICMP Objects

An Internet Control Message Protocol (ICMP) object is a service object specifically for ICMP and IPv6-ICMP objects. CDO recognizes these objects in ASA configurations and gives them their own filter of "ICMP" so you can find them easily.