Firepower Threat Defense VPN

[mwuk11]

I have a site-to-site VPN that terminates on a Firepower 2100 firewall. The host IP is specified in the VPN configuration, but a scan from outside our firewall will now show udp port 500. Is there a way to filter this, so that only the remote VPN endpoint can see udp 500?

Thanks for any suggestions

[Marvin Rhoads]

I don't believe that can be done with FTD.

On FTD, your standard Access Control Policies and Prefilter policies all affect traffic THROUGH the device - not traffic TO the device.

On ASA we had the option of adding "control-plane" keyword to an ACL entry but that option is not available on FTD.