The controller is listening for the multicast put out by the player after the Join button is pressed. I don’t know offhand the multicast address but someone using VLANs may be able to comment.

I seem to recall that some folks simply move the control device onto the Sonos subnet temporarily to complete the setup.

Can I have a tech provide more information on diagnostic 498303328?

@domconscious Thank you for bringing your question(s) to us here and welcome to the Sonos Community. I am not sure what you are expecting for us to see in the diagnostic report that ratty has already pointed out. In your highly secure network you will need to confirm network settings for multi-casting and STP settings. You would also want to confirm firewall settings. I would only suggest a full network and Sonos product re-boot along with the device running the Sonos app after any settings changes have been made.

Your network setup may meet our system requirements but the settings would still have to be confirmed on your end. Also, please confirm that none of the products for your network are on our incompatible hardware list.

Well, this begs the question:  What is included in the diagnostics?  Does it contain any details as to what the app expects to hear from the speaker on a network level?

My network routes and sends multicast traffic to the subnet the iOS app sits, the firewall is wide open for testing, but I will see if something might block or otherwise disable Spanning Tree Protocol.

STP doesn’t apply between subnets. It’s an L2 bridging protocol. It only matters within a SonosNet/”wired” setup (not WiFi/”wireless”) and, for network infrastructure, where multiple Sonos units are wired.

You probably want to look out for multicast (or possibly broadcast) from the player when you push the button. Wireshark might be useful.

Yours isn’t an officially supported arrangement so you may have to rely on mutual support here from other users trying to work Sonos across multiple subnets. Also try https://www.reddit.com/r/sonos/

BTW if you hadn’t actually seen it you might be interested in this thread.

https://en.community.sonos.com/troubleshooting-228999/multiple-subnets-vlans-and-sonos-workable-clavister-solution-30950

Workaround:

Connected a backup wireless AP to the Sonos VLAN.  I was able to add the new speakers without any trouble.  After removing the AP, I’m still able to take advantage of my current network segregation via VLAN.  I am using my secured VLAN/SSID and able to access the Sonos VLAN with new speakers.

It appears something just isn’t traversing the network, beyond multicast and mDNS.  PIMD and Avahi services on the PFSense show data passing the firewall without any problem.

Paul

It could be as simple as the controller refusing to let an off-subnet device join the system, on security grounds. In recent times the players have become fussy about accepting a connection to the :1400 status pages from an off-subnet source when it’s been port-forwarded inbound.

Controller being the iOS app, correct?  Perhaps Sonos updated the app to prevent it.

Analysis (packet capture) of the firewall showed nothing was being blocked.  All traffic was being forwarded bidirectionally from both VLAN routed ports.

Yes, the apps are controllers.