Connecting to Management GUI remotely on a different port.

[Walt]

I have a PA500 offsite that I manage remotely by connecting to the outside interface IP address, let's call it 188.1.1.1. My issue is I want to also set up a Global Protect SSL VPN gateway and the only IP choice it gives me is the outside interface 188.1.1.1/28. If I configure that then I can no longer reach the Management GUI remotely. Is there a way to change the GUI to another port or move it to another IP address I have available ?

[gwesson]

First, I have to mention that it is probably a bad idea to put firewall management on a public interface. I highly recommend against doing that.

If you must, please restrict it to the IPs you're using and ideally lock it down to multi-factor auth.

edit: Here's the official best practices for management of the devices:

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/getting-started/best-practices-for-s...

That said, if you do want to put GlobalProtect (GP) as the same interface as a dataplane port for which you have enabled management, the firewall will automatically shift the management listener to port 4443 while keeping GP on 443. It's not something that can be customized so you'll need to make do with those ports, but will allow you to access the management service and still provide GP functionality.

[BPry]

@Walt,

Sure. You do this via a loopback interface in the Trust zone. 

1) Configure the loopback interface on the firewall and assign the Mangement Profile.  (Only assign Management Profile to loopback)

2) Configure a custom service for the non-standard port that you want to use. 

3) Configure destiantion NAT policies to translate the custom ports to the loopback on the default access ports. 

4) Configure the security policies to actually allow the traffic. 

Should be good, since your non-standard ports are going to redirect to the loopback you shouldn't run into any issues. 

*edit* I had no idea it actually moved to 4443 as @gwesson stated, however since that port is common in automated scans I wouldn't really want to use that one. Obviously this should be restricted to the IP that you would actually be coming from.