Contributor I

Answered

Unable to AirPlay to Era 100 in separate VLAN (Ubiquity)

48 replies
3733 views

I have a Ubiquity Unifi network with a separate VLAN for my Sonos speakers. They all work perfectly fine (set on SonosNet) + a Roam on WiFi, except for the Era 100 (which is connected to ethernet with the Sonos Combo Adapter). I am unable to connect any device via AirPlay. When I move the Era back into LAN (same VLAN as other devices) it works instantly.

This topic has been closed for further comments. You can use the search bar to find a similar topic, or create a new one by clicking Create Topic at the top of the page.

Stanley_4Answer

Grand Maestro

Sonos needs to be on a single network

Show previous replies

K

kingebeng

Trending Lyricist I

Spent a little time digging into the issue. To recap, though, everything was working fine until the `81.1-58210` software release which was installed across my system on Oct 21st. Airplay across VLANs worked fine with all speakers; after the system update, Airplay across VLANs stopped working with the newer speaker hardware.

The issue is that the Precision Time Protocol service does not start up properly on the newer speakers. When an Airplay stream is initiated, the sending device contacts the speaker on port 7000. As the devices negotiate the Airplay protocol, the Airplay device starts sending PTPv2 packets to ports 319 and 320 on the Sonos speakers. The speaker initially responds with some ICMP “port unreachable” responses because the Precision Time Protocol service is still starting up, but eventually the speaker starts sending back PTPv2 packets so the devices can coordinate on time and account for audio delay.

The newer Sonos speakers never send PTPv2 packets in response. The Airplay device is sending these packets to coordinate on time, but the Sonos speaker always responds with the ICMP “port unreachable” packets - it never starts listening for these PTPv2 packets.

Again, this only happens across VLANs - if both devices are on the same subnet, then the issue does not happen.

For corporate environments (retailers, etc) keeping devices like Sonos speakers, lighting systems, etc separate from the point-of-sale terminals is very important from a security perspective. For home users, this security by separation is just as important especially with some work-from-home environments.

Hopefully this is an error / oversight and not an intentional change by Sonos, and hopefully Sonos can remedy the situation in a future software update.

PS - If any engineers at Sonos stumble across this thread, please feel free to contact me directly and I can provide some tcpdump packet captures that illustrate the issue. The initial Airplay handshake with the speaker is successful; the speaker just never responds to PTPv2 packets on ports 319 or 320.

Cheers!

thank you for the very well explained problem discription.

@SONOS when are you planning to fix this?
as it is stated here, its not something only for home users but also for a lot of businesses where the IoT is separated from all the other networks. Can we please have a fix as soon as possible?

F

furacaopr

Prodigy III

I don't get it. You segregate the devices and then grant them trusted status so they are not segregated anymore?!? What's the point? How could this improve security in any way?

K

kingebeng

Trending Lyricist I

I don't get it. You segregate the devices and then grant them trusted status so they are not segregated anymore?!? What's the point? How could this improve security in any way?

You clearly dont know what Network Security is :)

You dont open ANY TO ANY or ALL ports… only what is required. Why should a sonos access your SMB or File shares? Or your Homesystem or Alarm securtiy or Cameras??? Did you think about having a brach on Sonos which could impact Applications or Pin terminals for payments? It all possible!!!

F

furacaopr

Prodigy III

That's why you are having issues. You don't know exactly what ports are required. It's a guess game.

F

furacaopr

Prodigy III

Not just that, but your phone is also a risk to your pin terminals. So keep.your work devices on one VLAN and Sonos and its controllers (phones, tablets,.etc) in another. But don't segregate your speakers from your controllers.

controlav

Lead Maestro

Not just that, but your phone is also a risk to your pin terminals. So keep.your work devices on one VLAN and Sonos and its controllers (phones, tablets,.etc) in another. But don't segregate your speakers from your controllers.

Yeah, the phone is a much higher security risk than the Sonos speakers. Just put them all in the same VLAN...

Author of the leading independent Sonos apps for Android, MacOS, iOS, Windows and Xbox.

K

kingebeng

Trending Lyricist I

But that is the point.

All different purposed end-nodes are specified and put into different “zones”.
Sonos devices are only allowed on “specific” ports to talk to the phones/ipads. And vica versa back. Nothing more! :)

C

craigski

Local Superstar

I don't get it. You segregate the devices and then grant them trusted status so they are not segregated anymore?!? What's the point? How could this improve security in any way?

You clearly dont know what Network Security is :)

You dont open ANY TO ANY or ALL ports… only what is required. Why should a sonos access your SMB or File shares? Or your Homesystem or Alarm securtiy or Cameras??? Did you think about having a brach on Sonos which could impact Applications or Pin terminals for payments? It all possible!!!

A more secure solution for playing music, if you are concerned about Sonos connected to your network and/or security breach, would be an analogue amplifier with no network capabilities connected to a CD player and some speakers. If you are concerned about privacy that someone may hear what you are listening to with the analogue amplifier and speakers, you could use headphones.

K

kingebeng

Trending Lyricist I

Please lets not diviate from the challange/problem what we are observing.
You can put everything on a flat network/subnet if you like.

Its a security principal that we would like to have this.

Done deal. So get a long :)

C

craigski

Local Superstar

Please lets not diviate from the challange/problem what we are observing.
You can put everything on a flat network/subnet if you like.

Apple requires the devices to be on same network:

https://support.apple.com/en-gb/105068

Make sure your iPhone or iPad and speakers or Apple TV are on the same network..

.
.

Your iPhone or iPad and your AirPlay-enabled device must be on the same Wi-Fi network before you can get automatic and suggested AirPlay connections.
.
.
You can send audio from Apple TV to one or more AirPlay-enabled devices, such as HomePod and other smart speakers and TVs, that are connected to the same network in your home.
.
.
Make sure your Mac and speakers are on the same network. Open the Apple Music app, click AirPlay in the playback controls, then select a speaker or multiple speakers.

I agree, you can hack your network into an unsupported vendor (Apple/Sonos) configuration for fun/educational purposes, but it is then unsupported.

Maybe if enough people request it, AirPlay3 will support VLANs?

Show more replies

Sign up

Login to the community