the issue seems to resolved by upgrade iDRAC firmware to 4.40.0.0
tried to disable the Web Management GUI, used the racadm command to disable WebServer, the iDRAC management GUI became not reachable, but after a day or two, the ports 80/443 became active again and can reach the iDRAC management GUI again. Firmware level = 4.20.20.20
iDRAC9 cannot disable port 80/443 for management GUI