Dear Wolfgang,
GAIA portal and other web services are definitely depend on l4 distribution when you are trying to access via uplink (not management) interfaces. That is because it pass via distribution. However, management interfaces are excluded from distribution mechanism and always threated by SMO (first SGM in security group).
HTTPs services are based on different ports, that is why same session is distributed across multiple SGMs, which cause such kind of issues.
Conclusion - always disable L4 distribution when using Web services that Security Group provide via uplink interfaces
Thanks
