Does GlobalProtect Require Interface Management Profiles with HTTPS to Function?

GlobalProtect does not need HTTPS from the interface management for the portal to function. It is recommended to review the Interface Management Profiles to ensure that loopback, physical interface or tunnel are NOT selected with HTTPS, and NOT applied to the GlobalProtect.

By default, when GlobalProtect portal is enabled it’s running on port 443.

If an interface management profile has been inadvertently applied to the loopback, or the physical interface for the GlobalProtect portal, the platform could potentially be vulnerable to the CVE-2017-15944 Vulnerability in PAN-OS and Panorama on Management Interface

Note: Interface Management profile with HTTPS enabled is running on port 4443.

See the following for additional resources:

• Resources to configure the GlobalProtect portal, gateway configuration.
  How to Configure GlobalProtect

• PAN-OS Networking Administrator's Guide
  Use Interface Management Profiles to Restrict Access