When troubleshooting captive portal, if you find that you cannot get the Redirect mode to work when you are redirecting to an IP that is on a loopback interface on the firewall, you need to enable “Response Pages” on the interface that is “closest” to the client. E.G. not necessarily on the loopback interface but rather on the interface (or sub-interface) that the client's packet will first hit when reaching the firewall.

https://live.paloaltonetworks.com/t5/Management-Articles/Troubleshooting-Captive-Portal-Redirect-Page-Issues/ta-p/55360

You will also need to enable a decryption profile and a security policy profile that allows access to TCP ports 80, 443 and 6082 on the Loopback interface.