Close UDP port 500 and only allow IPsec peer

[mmzzaq]

I was finishing up a Asa 5506-X config and just to make sure everything was setup correctly and safe, I did a portscan to the Asa's WAN port from a computer on the internet. I noticed UDP port 500 was open and I figure it's needed for our lan to lan VPN tunnel between the Asa and a firewall on a remote location.

Is it possible I close this port with a firewall rule so it's only accessible by the firewall on the remote location? Something like this (incoming):

allow udp 500 from <remote location ip>
deny udp 500 from any

(Syntax not good but not asking for this, just wondering about the general concept)

Thanks in advance

[Rob Ingram]

Hi,

Perhaps you could consider a control-plane ACL, this is used to restrict access to the ASA. Example here.

HTH

[mmzzaq]

Thanks for the info. That looks like something I could use. Will try it soon, cheers.