When HTTPS for management and GlobalProtect are enabled on the same interface, which TCP port is used for management access?

When both the HTTPS management web interface and a GlobalProtect portal or gateway are configured on the same firewall interface, a port conflict arises as both services default to TCP port 443. To resolve this, PAN-OS prioritizes the GlobalProtect service, which continues to use the standard TCP port 443. The firewall automatically moves the HTTPS management service to the alternate port TCP 4443. This allows administrators to manage the firewall while remote users connect via GlobalProtect on the same IP address.

A. 80: This is the default port for unencrypted HTTP management, not the secure HTTPS service in question.
B. 8443: While a common alternate port for HTTPS in other applications, it is not the specific port PAN-OS uses for this conflict scenario.
D. 443: This port is reserved for the GlobalProtect service when it is enabled on the same interface as HTTPS management.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: In the section "Device > Setup > Management," the guide details the configuration of management services. It explicitly states, "If you enable both GlobalProtect and web interface management on the same interface, the web interface automatically moves to port 4443." (Reference: "Configure Management Interface Access" section).

2. Palo Alto Networks GlobalProtect™ Administrator's Guide 10.1: In the section on configuring the GlobalProtect Portal, the documentation notes the default port is 443. It implicitly supports the port-sharing logic by detailing how GlobalProtect takes precedence. (Reference: "Set Up the GlobalProtect Portal" section).

3. Palo Alto Networks Knowledge Base Article #2285: Titled "WebGUI and GlobalProtect on the Same Interface," this article directly addresses the scenario. It confirms: "When GlobalProtect is configured on an interface, it will take precedence for port 443. The WebGUI will be moved to port 4443."