Cisco FTD Listening on Port 443 on outside interface

[SHABEEB KUNHIPOCKER]

We underwent a recent security penetration test, which revealed that the outside interface of our Cisco FTD firewall is listening on TCP port 443. According to the configuration, SSL (HTTPS) access on this interface has already been disabled. The FTD is configured with AnyConnect VPN using only IPsec (IKEv2), and not SSL VPN. However, both 'IPSEC IKEv2' and 'IPSEC IKEv2 client services' are enabled under IKEv2 settings (when we check from the CLI). We are not able to find an option to disable client services in FTD. We are also concerned about whether removing the 'client services' configuration would negatively impact their many existing site-to-site VPN tunnels, which are essential for business operations. The issue poses a compliance risk as flagged by the penetration test, but the business must avoid disruption to ongoing operations supported by these tunnels. Please help us to resolve this issue.

We have the below commands present in our FTD CLI. We cannot find a way to disable it from FMC. 

crypto ikev2 enable outside client-services port 443

Regards

Shabeeb

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/routers/rv110w-wireless-n-vpn-firewall/222890-configure-custom-port-for-ravpn-on-ftd-m.html

the S2S VPN will not effect by change clinet service port 

MHM

[balaji.bandi]

If you do not need to download client image and have different way to push to end client, then you can disable.

i dont remember steps on top of my head.

Navigate to VPN settings: Go to Devices > VPN > Remote Access.

Edit the IPSec crypto maps: Under the IPsec tab, find the Crypto Maps section and edit the policy.

[Marvin Rhoads]

Disabling client services will not affect site-to-site VPNs.

It will affect the ability to push profile and Secure Client updates as those rely on client services over SSL/TLS - even with a remote access VPN that otherwise uses IPsec IKEv2.

See my whitepaper here for more details: https://community.cisco.com/t5/security-knowledge-base/configuring-ipsec-ikev2-remote-access-vpn-with-cisco-secure/ta-p/4485165