How do I disable port 500 being open on multiple external IP addresses when only a few are being used?

Question

We have a XG 310 in our main office which has two internet connections. The first we consider our "main" connection and has 5 IP addresses serving up some secure websites, OWA, SSL VPN, and general internet access. The second has 5 external IP addresses and is used only for B2B IPSec VPNs. On a recent PCI compliance scan the report showed port 500 being opened on 4 of the 5 IP addresses used on the main connection (.98 - .102) and only one on the secondary (.162):

Any ideas on why port 500 would be responding on the other ports when there should be no services setup to use it?

This thread was automatically locked due to age.

Any ideas on why port 500 would be responding on the other ports when there should be no services setup to use it?

lferrara · Accepted Answer

AllanD , 
 IPSec VPN service on XG listens on all WAN interfaces/IP by default. For other services, you can restrict the listening by using local ACL unders Administration > Device access. 
 A feature request was marked as completed but it is not and Sophos should consider all the services that are missing on Local ACL: 
 https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/16593775-assign-the-built-in-services-vpns-admin-etc-to 
 but nothing changed since then! 
 [:'(]

AllanD · Answer

That's what I was afraid of. I already have added restrictions for the User Portal and SSL VPN under Administration > Device access to block those from all external IP addresses except for those that should actually host those services. I'd like to block port 500, port 3400 (for RED devices), and some others as they keep coming up on my PCI compliance scans. 
 AlanT - Can you please remove the "Already Possible" from https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/16593775-assign-the-built-in-services-vpns-admin-etc-to as it is not. Other services like mentioned above cannot be blocked and advertise on every IP address on WAN interfaces which causes a huge headache putting in exception requests with my PCI compliance scanning company. Each time they ask me why the port is open when I'm not hosting a service and I don't have a good explanation other then because my firewall can't do it. 
 Also added another feature request and pointed it back to the original which is not possible: https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/39323809-ability-to-restrict-all-system-services-under-adm