Which Cisco AnyConnect component ensures that devices in a specific internal subnet are only accessible using port 443?

Routing determines the forwarding path for traffic but provides no mechanism to enforce port-level restrictions on which traffic may reach a subnet.

WebACL is not a standard Cisco AnyConnect component used to restrict VPN session traffic by port or protocol.

Split tunneling divides traffic between the corporate VPN tunnel and the local internet but does not enforce port-based access control to specific internal subnets.

A VPN filter is an ACL that the ASA applies directly to a VPN session, enabling granular control over which protocols and ports are permitted to reach internal resources. It can be configured to permit only TCP port 443 traffic destined for the specified internal subnet, enforcing port-based access restrictions on VPN-connected users. This is distinct from general routing or group policy and is the only AnyConnect component designed for per-session traffic filtering at the port level.