Extron NAV
Extron NAV is Extron's AV-over-IP platform — it replaces traditional HDMI matrix switchers by distributing video and audio across a standard Ethernet network. An NAV encoder (connected to a video source) converts the signal into encrypted network packets using Extron's proprietary PURE3 codec; an NAV decoder (connected to a display) receives and converts them back to video. Routing is managed by the NAVigator, a dedicated hardware appliance with a browser-based interface. NAV competes directly with Crestron NVX and is a credible alternative in corporate and higher-education AV. It supports AES67 audio interop, AES-256/FIPS 140-2 security, and 802.1X network access control — features that make it viable in government and secure enterprise environments.
By Extron
Video Transport
Network Ports & Requirements
| Port(s) | Transport | Direction | Purpose | DSCP | Multicast | Config. |
|---|---|---|---|---|---|---|
| 5004 | Multicast | Both | PURE3 video and audio streams — the actual video and audio data flowing from encoder to decoder(s) using Extron's proprietary wavelet codec, wrapped in SRTP (encrypted RTP). Default bitrate up to 850 Mbps for 1G systems. Blocking this stops video entirely. | — | — | Yes |
| 5004 | Multicast | Both | AES67 audio stream — a separate AES67-formatted audio multicast alongside the video stream, enabling interop with non-Extron AES67 devices (e.g. Q-SYS, Biamp). The last two octets of the multicast address are derived from the encoder's MAC address by default. | — | — | Yes |
| 319 | Multicast | Both | PTP v2 clock synchronisation — required for AES67 audio timing. All NAV devices and AES67-connected equipment must share a PTP clock domain. Blocking these ports causes AES67 audio to lose sync. | — | 224.0.1.129 | No |
| 320 | Multicast | Both | PTP v2 clock synchronisation — required for AES67 audio timing. All NAV devices and AES67-connected equipment must share a PTP clock domain. Blocking these ports causes AES67 audio to lose sync. | — | 224.0.1.129 | No |
| 443 | TCP | Both | HTTPS — NAVigator System Manager web interface (routing, monitoring, preview, system configuration) and individual device web management. Primary management path. | — | — | No |
| 80 | TCP | Both | HTTP — NAVigator and device web interface, redirected to HTTPS. | — | — | No |
| 22 | TCP | Inbound | SSH — secure command-line access to NAV devices for maintenance and diagnostics. Disable when not in active use. | — | — | Yes |
| 4502 | UDP | Both | Extron Toolbelt discovery — broadcast-based device discovery used by Extron Toolbelt software for firmware updates, SSL certificate uploads, and device configuration. Only active when Toolbelt is in use. | — | — | No |
| 5353 | Multicast | Both | mDNS — local network device discovery. Used alongside Toolbelt and some NAV management functions to find devices by hostname. Does not cross VLAN boundaries. | — | 224.0.0.251 | No |
| 161 | UDP | Inbound | SNMP — network monitoring. Allows network management systems (NMS) to poll NAV device status. Optional; only required if SNMP monitoring is in use. | — | — | Yes |
| 67 | UDP | Both | DHCP — IP address assignment. NAV devices request addresses via DHCP by default; fall back to link-local (169.254.x.x) if no DHCP server is available. Port 68 = client, 67 = server. | — | — | No |
| 68 | UDP | Both | DHCP — IP address assignment. NAV devices request addresses via DHCP by default; fall back to link-local (169.254.x.x) if no DHCP server is available. Port 68 = client, 67 = server. | — | — | No |
| 1812 | UDP | Outbound | RADIUS authentication — used only if 802.1X port-based network access control is enabled. NAV devices authenticate against a RADIUS server before being permitted on the network. Only required in 802.1X environments. | — | — | Yes |
| 1813 | UDP | Outbound | RADIUS authentication — used only if 802.1X port-based network access control is enabled. NAV devices authenticate against a RADIUS server before being permitted on the network. Only required in 802.1X environments. | — | — | Yes |
| — | Layer 2 | Both | Link Layer Discovery Protocol — devices advertise themselves to adjacent network switches for topology mapping. No IP ports involved; managed at switch level. | — | — | No |
Gotchas & IT Notes
- ⚠NAV video (UDP 5004) is **multicast-based** — IGMP snooping with querier is **mandatory** on all switches in the AV VLAN. Without it, multicast video floods all ports and saturates the network.
- ⚠IGMPv3 is required (not just v2) — NAV uses source-specific multicast (SSM) for security; verify switch IGMPv3 support.
- ⚠Each NAV encoder stream uses its own multicast group in the 239.x.x.x range. For inter-subnet deployments, PIM-SSM using the 232.0.0.0–232.255.255.255 range is recommended (per Extron NAV Network Guidelines).
- ⚠**Jumbo frames recommended** — configure 9000 MTU on all switches in the NAV VLAN for high-bitrate streams. Standard 1500 MTU will cause fragmentation at peak bitrates.
- ⚠**QoS/DSCP required** — Extron recommends EF (DSCP 46) for video streams, AF41 for audio. Configure strict priority queuing on all switches.
- ⚠NAV requires a **dedicated AV VLAN** — do not share with general corporate traffic. A separate management VLAN for HTTPS/SSH access is best practice.
- ⚠10GbE switch infrastructure required for 10G NAV systems; 1GbE sufficient for 1G NAV at standard bitrates.
- ⚠AES-256 encryption (device security) + AES-128 SRTP (stream encryption) + FIPS 140-2 certification — NAV is suitable for government and secure enterprise deployments.
- ⚠**HDBaseT reference:** HDBaseT has no native IP port numbers for the AV transport. See `library/cables-signals/hdbaset.md` for physical specs, distance, cable, `PoH`, version, and USB-extension boundaries; schedule only the adjacent tunneled Ethernet/control services that the selected endpoints actually expose.