topic Re: allow Sonos app throught checkpoint in Firewall and Security Management

allow Sonos app throught checkpoint

Arthur_DENIS1 — Fri, 18 Nov 2022 16:02:05 GMT

Hello guys !

I'm stuck with my home lab, trying to do some test with multicast throught checkpoint.
I've a user vlan 4 (192.168.4.0/24) and a media vlan 6 (192.168.6.0/24).

A sonos server is hosted in vlan 6 with ip 192.168.6.54.
Sonos app is on vlan 4.

As far i understood, sonos use SSDP over UDP/1900 to discover sonos device (see wireshark in attachment).

I've try to configure this:
set igmp interface eth2.6 version 3
set igmp interface eth2.6 local-group 239.255.255.250 on
set iphelper interface eth2.4 udp-port 1900 relay-to 192.168.6.54 on

However it's not working..
I got this error message in smartconsole (see screenshot)

Do you have some input to help me to address this issue ?

Thanks,
Arthur

Re: allow Sonos app throught checkpoint

PhoneBoy — Fri, 18 Nov 2022 19:56:29 GMT

Multicast traffic does not route.
You have to set up PIM in order to relay it between the subnets and have appropriate rules in place to allow the traffic.

Re: allow Sonos app throught checkpoint

Arthur_DENIS1 — Sat, 19 Nov 2022 15:08:01 GMT

huuum ok. Never play with PIM...

If I setup PIM i got this:
"IP multicast routing failed (too many packets received before route was resolved)"... Not really better 😞

I do another test - If I put my sonos app in the same subnet of server, i got the attached capture.
(sonos app= 192.168.6.56 - server= 192.168.6.54)
1/ 192.168.6.56 -> 239.255.255.250 - SSDP
2/ 192.168.6.56 -> 235.255.255.255 - SSDP
3/ 192.168.6.54 -> 192.168.6.56 - UDP
Here discover is done
4/ then TCP connection between both host

So indeed, seems definitively an issue with multicast/PIM.

Re: allow Sonos app throught checkpoint

PhoneBoy — Sat, 19 Nov 2022 20:42:28 GMT

Will admit, I’ve never tried PIM with Sonus.
I know I’ve done it with Bonjour (Apple-specific protocol) in the past.

Re: allow Sonos app throught checkpoint

Arthur_DENIS1 — Mon, 21 Nov 2022 16:38:25 GMT

No prob, thanks anyways for your input !

If someone else have an idea or already try this, would be very appreciated