How to prevent Mikrotik from setting up a vpn tunnel on port 4500?

Question

Computer networks

Good afternoon, there is such vpn scheme:
ipip tunnel over ipsec. In profile, nat-t is disabled, but Mikrotik still raises (not always) a tunnel on port 4500

How to prevent Mikrotik from starting a vpn tunnel on port 4500? What would be the default port 500.

Answer 1

If the stars are lit, then someone needs it (C) V.V. Mayakovsky
If IKE switches to 4500, then there is NAT-T somewhere. Forbid it (if possible) - and there will be no tunnel :)