Connecting to Management GUI remotely on a different port.

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Connecting to Management GUI remotely on a different port.

L1 Bithead

I have a PA500 offsite that I manage remotely by connecting to the outside interface IP address, let's call it My issue is I want to also set up a Global Protect SSL VPN gateway and the only IP choice it gives me is the outside interface If I configure that then I can no longer reach the Management GUI remotely. Is there a way to change the GUI to another port or move it to another IP address I have available ?


L7 Applicator

First, I have to mention that it is probably a bad idea to put firewall management on a public interface. I highly recommend against doing that.


If you must, please restrict it to the IPs you're using and ideally lock it down to multi-factor auth.

edit: Here's the official best practices for management of the devices:


That said, if you do want to put GlobalProtect (GP) as the same interface as a dataplane port for which you have enabled management, the firewall will automatically shift the management listener to port 4443 while keeping GP on 443. It's not something that can be customized so you'll need to make do with those ports, but will allow you to access the management service and still provide GP functionality.

Cyber Elite
Cyber Elite


Sure. You do this via a loopback interface in the Trust zone. 

1) Configure the loopback interface on the firewall and assign the Mangement Profile.  (Only assign Management Profile to loopback)

2) Configure a custom service for the non-standard port that you want to use. 

3) Configure destiantion NAT policies to translate the custom ports to the loopback on the default access ports. 

4) Configure the security policies to actually allow the traffic. 

Should be good, since your non-standard ports are going to redirect to the loopback you shouldn't run into any issues. 


*edit* I had no idea it actually moved to 4443 as @gwesson stated, however since that port is common in automated scans I wouldn't really want to use that one. Obviously this should be restricted to the IP that you would actually be coming from. 

  • 2 replies
  • 101 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!