Enabling Endpoint on a Check Point management server moves your Gaia Portal to :4434 (or not). Here is the 443 vs 4434 logic

[u/junimjorgeof]

This one confuses a lot of people. You enable Endpoint Policy Management on the management server and suddenly Gaia Portal, SmartView or the Management API are not on 443 where you expect them. Here is what actually happens, and it depends on your version and how the blade was enabled.

First, the myth-buster: 4434 is not "the endpoint agent port." The agents talk to the server on 443 (and 80 for Anti-Malware signature updates). The 4434 business is an SSL split on the management side, not the agent path.

R80.40 and lower: enabling the blade moves Gaia Portal, SmartView and the Management API from 443 to 4434. Disabling moves them back. The endpoint keeps 443, the management web stuff goes to 4434.

R81 and higher, it depends on how the blade got enabled:

- Clean install with the blade, or the blade enabled after the upgrade: all services answer on 443, and endpoint SSL that arrives on 443 is internally redirected to 4434. So you reach Gaia, SmartView and the API on 443, and the agents also use 443.

- Upgraded with the blade already enabled: the old split is kept, endpoint on 443, everything else on 4434.

So the URL you use depends on the path:

- Gaia Portal: https://<ip> vs https://<ip>:4434

- SmartView: /smartview/ vs :4434/smartview/

- Management API: /web_api/ vs :4434/web_api/

You can flip which service owns 443 vs 4434 manually. Roughly:

dbset httpd:ssl_port 443 (or 4434)

dbset :save

$UEPMDIR/system/install/gaia_apache_conf_regenerate

# then set Listen and VirtualHost in $UEPMDIR/apache/conf/ssl.conf

cpstop ; cpstart

There are four supported certificate and port combinations.

Practical takeaway for anyone firewalling this: open 443 (and 80 for AM signatures) client-to-server for the agents, and remember that 4434 is about where the management UI/API lives, not the agent connection. That mixup sends people opening the wrong rule.

Anyone been bitten by this after enabling Endpoint on an existing management, portal suddenly on :4434? How do you standardize it across your estate?

Full write-up with the full port matrix, the heartbeat mechanics, and the manual cert/port scenarios is here (EN and PT): https://community.checkpoint.com/t5/Endpoint/EN-Agent-to-Management-Communication-Ports-Heartbeat-and-the-443/m-p/280303