AutoCommit failed after PAN-OS upgrade from 10.2.x to 11.1.x
928
Created On 05/23/25 19:30 PM - Last Modified 10/13/25 15:44 PM
Symptom
- After PAN-OS upgrade, AutoCommit fails with the following error:
> show jobs id 1
Enqueued Dequeued ID Type Status Result Completed
------------------------------------------------------------------------------------------------------------------------------
YYYY/MM/DD HH:MM:SS HH:MM:SS 1 AutoCom FIN FAIL HH:MM:SS
...
Details:vsys1 (vsys1)
Error: Should configure either/both authentication profile or/and client certificate profile when captive portal is enabled for vsys vsys1
(Module: device)
client device phase 1 failure
Commit failedEnvironment
- Palo Alto Networks Firewalls
- Authentication Portal (Captive Portal)
- PAN-OS 11.1.0 and higher
Cause
Starting PANOS 11.1, Captive Portal Configuration check is strengthened
Resolution
- Configure Authentication or Certificate profile under
- Device > User Identification > Authentication Portal > Authentication Profile
- Without an Authentication Profile configured, the Authentication policy configuration is invalid
Note: If authentication rule is configured with authentication enforcement object as default-web-form or default-browser challenge (Captive Portal enabled), Authentication or Certificate profile needs to be configured