Can't stop connections to my 325 router on ports 500 and 4500

[ftierno]

Using access rules I pretty much have my router locked down the way I want it, however I can't seem to stop connections (UDP)

to ports 500 & 4500 no matter what I do. Anyone have any ideas? My ISP is Comcast (Business class) in NJ.

IS there some technical reason the router is allowing these connections?

[cj.johnson3cigna]

Can you post the ACL or ZBF rules you're using?

[ftierno]

Yes I took a screen shot.

[ftierno]

And here is the latest unauthorized connection from this morning:

May 31 09:29:25 2017 Mainrouter ALLOW UDP 191.96.249.12:38343 -> xx.xx.xx.xx on eth1 (I edited out my IP address)