topic Re: Port 4443 in General Topics

Port 4443

Jack_Howells — Tue, 14 Jun 2016 15:29:43 GMT

It has been noted that our global protect portal is reachable from the internet using port 4443 and is presenting a self signed cert which is seen as a security vulnerability. Can you let me know if port 4443 is necessary in terms of GlobalProtect connectivity?

The below comes to mind, but does anyone have any suggestions?

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Access-the-WebGUI-when-GlobalProtect-Is-Enabled/ta-p/62399

Cheers

Jack

Re: Port 4443

Transporter — Tue, 14 Jun 2016 15:54:16 GMT

Hihi,

Actually your WEB GUI PA server switched to the port 4443 when you have GP enabled. GP running on the port 443.

Re: Port 4443

Jack_Howells — Tue, 14 Jun 2016 15:56:21 GMT

Okay, thanks for the confirmation.

Port 4443 will be needed then, but is there anything else we could do?

Re: Port 4443

Transporter — Tue, 14 Jun 2016 15:59:50 GMT

Hi Jack,

can you please clarify what exactly do you want to achieve?

Thank,

Mykhaylo

Re: Port 4443

Jack_Howells — Wed, 15 Jun 2016 10:43:18 GMT

Hi Mykhaylo,

Basically, I would like to know if port 4443 is needed. I don't think it is, unless you have set the GP portal to be on the management interface, which isn't the case. If it was, I would need 4443 because that is how you get to the management instead of the portal, on the same interface/IP.

Cheers

Jack

Re: Port 4443

Raido_Rattameister — Wed, 15 Jun 2016 10:49:19 GMT

I would definitely not allow firewall management from external interface.

You can check what management profile is attached to untrust interface if you go to

Network > Interfaces and check "Management profile" column.

Then go to

Network > Network Profiles > Interface Mgmt

And create new profile for wan side or change current one.

If you need mgmt access from wan then at least limit it down with security policy to whitelisted IPs.

Re: Port 4443

Jack_Howells — Wed, 15 Jun 2016 10:53:09 GMT

Hi Raido,

Thanks for your response,

However, as said above I'm not using management on an external interface.

Cheers

Jack

Re: Port 4443

Raido_Rattameister — Wed, 15 Jun 2016 10:58:07 GMT

If you use globalprotect and have enabled management on same interface then management port jumps from 443 to 4443.

Are you sure you have not attached interface management profile to untrust interface that permits management through this untrust interface?