Can someone confirm: When a service hits the CSS, the match made to a source group is ONLY on the IP address, not port/protocol/IP..right?
In other words, I can't specify
service www1-tcp
protocol tcp
ip address 1.1.1.1
and
service www1-udp
protocol udp
ip address 1.1.1.1
then put service www1-tcp in a source group and not expect outbound udp traffic to succeed also.