boot environment reset to 25.07 - after update to 26.07 >> pfSense-repoc: zuul_license_check: Failed to check the license

SE 0

I've been running a Fujitsu D538 as a PFsense server in my HomeLab for some time now.
It was upgraded to Plus years ago, when Plus was still free.
Back then, I had set up the same computer as a backup in the cabinet.
That one was also activated while the upgrade to Plus was still free.

Unfortunately, I experienced a hardware failure on the production firewall last week.
I spent a long time troubleshooting, and it turned out that the network card was causing the problem.

While I was trying to pinpoint the problem, I had swapped out the components on a nearly identical computer.

During troubleshooting, I noticed that the boot environment on both PFsense boxes had reverted to 25.07. After updating to 26.07, I received the following error messages in the “Update” menu on both Fujitsu D538 computers, which both had a PFsense Plus license.

PFsense 1 (production):
pfSense-repoc: zuul_license_check: Failed to check the license (1). 
pfSense-repoc: server returned error response: 400 Bad Request 10405 - device fingerprint not recognized 
pfSense-repoc: zuul_license_fetch: Failed to check the license (1). 
pfSense-repoc: server returned error response: 400 Bad Request 10405 - device fingerprint not recognized

PFsense 2 (backup):
pfSense-repoc: zuul_license_check: Failed to check the license (1). 
pfSense-repoc: server returned error response: 400 Bad Request 10404
pfSense-repoc: zuul_license_fetch: Failed to check the license (1). 
pfSense-repoc: server returned error response: 400 Bad Request 10404 
pfSense-repoc: zuul_repo_fetch: Failed to read the repository data (1). 
pfSense-repoc: server returned error response: 400 Bad Request 10416

Have my two PFsense boxes now been blocked so that I can no longer receive updates, or is there a way to clear these messages?

Thank you very much and best regards from southern Germany

SteveITS

@SE-0 Changing NICs will result in a different NDI (fingerprint) and invalidate the Plus license. Based on other posts here if you ask Netgate TAC support they will transfer the license, I think once?

re: boot environment, if pfSense Plus detects a boot failed (incomplete, or took longer than the default 10 minutes) it will revert to a known good BE, meaning, the previous one. You can probably just pick "default" again and boot into it. I had this happen during an upgrade once, because pfBlocker took too long to update lists, and the timer triggered.

SE 0

Hi @SteveITS,

Thanks for your quick reply.
On the production PFsense, it’s possible that the NDI (fingerprint) has changed.

However, that’s definitely not the case with the backup PFsense—the Netgate Device ID and the license phrase are still the same. (That’s the info shown to me in the dashboard.)
I had written those down earlier.

I’ll try that approach and contact Netgate TAC support; I hope the guys can help me get out of this mess.

Thank you very much, and best regards from southern Germany

patient0

@SE-0 said in boot environment reset to 25.07 - after update to 26.07 >> pfSense-repoc: zuul_license_check: Failed to check the license:

That one was also activated while the upgrade to Plus was still free.

Is your license a "2022 Limited Time pfSense Plus Promotion" License?
https://forum.netgate.com/topic/201172/the-2022-limited-time-pfsense-plus-promotion (from 18. August 2026)

"Home or Lab Evaluation" licenses are still good but you may to send your NDI to @stephenw10 if it behaves as if not registered.

stephenw10

Yes send me the NDI from both boxes in chat and I'll check them.