Anyconnect Ikev2 VPN and NAT possible port conflict

[Lee Dress]

I'm looking to enable Ikev2 for anyconnect and disable SSL.

My concern is on the change log when I go to deploy it, the IPsec Proposal says port 443.

We nat Port 443 down to out on site exchange server for hybrid email.

Our SSL vpn has been redirected to another port to prevent any conflict.  I'm just concerned that this will interfere with the hybrid exchange environment.  does anyone know if this will be an issue?  we'd like to get off of SSL vpn just because of the brute force stuff that's been going on.

[MHM Cisco World]

Need to check this point' but the ipsec anyconnect use http to download the xml and image it use.

If you can add xml manually to pc and disable auto-update that maybe solve issue

MHM

[Lee Dress]

I manually changed the xml on the client I'm testing with to try the IPSec.

I added a second server as "VPN-IPsec" and made the Primary Protocol IPsec, so I think the client side is fine. I was concerned about the port 443 on the Firewall side.

[Rob Ingram · Accepted solution]

@Lee Dress

thats Client Services port which is used to download secure client/anyconnect updates, profiles and other settings. You can specify a different port or disable (if you do that the clients will not receive updates).

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/740/management-center-device-config-74/vpn-remote-access.html

[Lee Dress]

We use "Device Insights" for updates, so I should be able to disable this.  I'll give it a shot and see how it goes.

[Lee Dress]

Thank you both.  this works. 

I can now move my Anyconnect users to Ikev2 and disable SSL,  I changed the port number in Client services to 9443, then disabled it just so I wouldn't be concerned about it.

[MHM Cisco World]

You are welcome 

MHM