Matter devices Secure Pairing Failed only in android app

[pbean]

The problem

I wanted to preface this by saying, the HomeAssistant Android repo told me it looks to be a problem with core not there app: please see home-assistant/android#5433 (comment)

Hello, Im new to HA and trying to setup these tapo matter plugs I just got with the matter controller add-on. I've tried everything I could think of. The network has IPv6 addresses and IPv4. HA has there one assigned. I have a fortigate firewall and I enabled multicast-forwarding and setup multicast ipv6 routing policies for my vlans. I even setup avahi and configured it as well and it sees all the multicast traffic from all my devices on the network just fine as well and has interfaces setup and configured on both vlans/subnets. However everytime it gets to setting up the device in homeassistant(after connecting, generating the matter authentication, and connecting to the network) it says something went wrong and fails out. I don't see any openthread logo on the device or the box or documentation so I believe its safe to assume its not thread based its a Tapo p125m.

UPDATE: I tried this on the 15th for hours with no luck. Eventually after so many resets the device stopped even letting me connect to it so, giving myself time to forget and reset I went and tried adding the device with an Apple Iphone 5 days later and it worked first try no problem with no changes to the environment so I will be using my iphone in the future and not putting any undue stress on the rest of the devices I bought to test this further other than one more time sorry.

Another Update: I've also bought a pack of Tapo(tp-link) 110m's and same issue, failed with android, worked first time with apple.

What version of Home Assistant Core has the issue?

core-2025.6.1

What was the last working version of Home Assistant Core?

No response

What type of installation are you running?

Home Assistant OS

Integration causing the issue

matter

Link to integration documentation on our website

https://www.home-assistant.io/integrations/matter/

Diagnostics information

No response

Example YAML snippet

Anything in the logs that might be useful for us?

2025-06-20 12:06:45.238 (MainThread) VERBOSE [matter_server.server.client_handler] [139964731797824] Received: {
"message_id": "1835f3b5bc2d417898e2391bdc7c84ee",
"command": "commission_on_network",
"args": {
"setup_pin_code": 96XXXXXX,
"ip_addr": "XXXX::XXXX:XXXX:XXXX:XXXX%45"
}
}
2025-06-20 12:06:45.238 (MainThread) VERBOSE [matter_server.server.client_handler] [139964731797824] Received CommandMessage(message_id='1835f3b5bc2d417898e2391bdc7c84ee', command='commission_on_network', args={'setup_pin_code': 96XXXXXX, 'ip_addr': 'XXXX::XXXX:XXXX:XXXX:XXXX%45'})
2025-06-20 12:06:45.238 (MainThread) VERBOSE [matter_server.server.client_handler] [139964731797824] Handling command commission_on_network
2025-06-20 12:06:45.238 (MainThread) DEBUG [matter_server.server.server] Setting scope of link-local IP address XXXX::XXXX:XXXX:XXXX:XXXX to enp2s1
2025-06-20 12:06:45.239 (MainThread) INFO [matter_server.server.device_controller] Starting Matter commissioning using Node ID 13 and IP XXXX::XXXX:XXXX:XXXX:XXXX%enp2s1.
2025-06-20 12:06:45.244 (ThreadPoolExecutor-0_0) DEBUG [matter_server.server.storage] Saved data to persistent storage
2025-06-20 12:06:45.668 (MainThread) DEBUG [matter_server.server.device_controller.mdns] Commissionable Matter node disappeared: AsyncServiceInfo(type='_matterc._udp.local.', name='2698B32AXXXXXXXX._matterc._udp.local.', addresses=[], port=None, weight=0, priority=0, server=None, properties={}, interface_index=None)
2025-06-20 12:06:45.689 (MainThread) DEBUG [matter_server.server.device_controller.mdns] Discovered commissionable Matter node: AsyncServiceInfo(type='_matterc._udp.local.', name='0D672A352XXXXXXX._matterc._udp.local.', addresses=[b'\xac\x10\x037'], port=5540, weight=0, priority=0, server='BC07XXXXXXXX.local.', properties={b'VP': b'4488+257', b'DT': b'266', b'DN': b'Mini Smart Wi-Fi Plug', b'T': b'1', b'D': b'740', b'CM': b'2', b'RI': b'0300727FAFEAF2XXXXXXXXEECD48A2XXXXXX', b'PH': b'36', b'PI': None}, interface_index=None)
2025-06-20 12:06:49.197 (Dummy-2) CHIP_ERROR [chip.native.EM] <<5 [E:26015i with Node: <0000000000000000, 0> S:0 M:122200140] (U) Msg Retransmission to 0:0000000000000000 failure (max retries:4)
2025-06-20 12:06:55.692 (Dummy-2) CHIP_ERROR [chip.native.SC] PASESession timed out while waiting for a response from the peer. Expected message type was 33
2025-06-20 12:06:55.692 (Dummy-2) CHIP_ERROR [chip.native.ZCL] Secure Pairing Failed
2025-06-20 12:06:55.692 (Dummy-2) WARNING [chip.ChipDeviceCtrl] Failed to establish secure session to device: src/controller/python/ChipDeviceController-ScriptDevicePairingDelegate.cpp:96: CHIP Error 0x00000003: Incorrect state
2025-06-20 12:06:55.693 (MainThread) ERROR [matter_server.server.client_handler] [139964731797824] Error while handling: commission_on_network: Commissioning failed for node 13.
Traceback (most recent call last):
File "/usr/local/lib/python3.12/site-packages/matter_server/server/device_controller.py", line 415, in commission_on_network
commissioned_node_id = await self._chip_device_controller.commission_ip(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/site-packages/matter_server/server/sdk.py", line 164, in commission_ip
await self._chip_controller.CommissionIP(
File "/usr/local/lib/python3.12/site-packages/chip/ChipDeviceCtrl.py", line 2259, in CommissionIP
return await asyncio.futures.wrap_future(ctx.future)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
chip.exceptions.ChipStackError: src/controller/python/ChipDeviceController-ScriptDevicePairingDelegate.cpp:96: CHIP Error 0x00000003: Incorrect state
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "/usr/local/lib/python3.12/site-packages/matter_server/server/client_handler.py", line 197, in _run_handler
result = await result
^^^^^^^^^^^^
File "/usr/local/lib/python3.12/site-packages/matter_server/server/device_controller.py", line 423, in commission_on_network
raise NodeCommissionFailed(
matter_server.common.errors.NodeCommissionFailed: Commissioning failed for node 13.

Additional information

No response

[home-assistant]

Hey there @home-assistant/matter, mind taking a look at this issue as it has been labeled with an integration (matter) you are listed as a code owner for? Thanks!

Code owner commands

Code owners of matter can trigger bot actions by commenting:

• @home-assistant close Closes the issue.
• @home-assistant rename Awesome new title Renames the issue.
• @home-assistant reopen Reopen the issue.
• @home-assistant unassign matter Removes the current integration label and assignees on the issue, add the integration domain after the command.
• @home-assistant add-label needs-more-information Add a label (needs-more-information, problem in dependency, problem in custom component) to the issue.
• @home-assistant remove-label needs-more-information Remove a label (needs-more-information, problem in dependency, problem in custom component) on the issue.

_{^{(message by CodeOwnersMention)}}

---

matter documentation
matter source
_{^{(message by IssueLinks)}}

[agners]

The network has IPv6 addresses and IPv4. HA has there one assigned. I have a fortigate firewall and I enabled multicast-forwarding and setup multicast ipv6 routing policies for my vlans. I even setup avahi and configured it as well and it sees all the multicast traffic from all my devices on the network just fine as well and has interfaces setup and configured on both vlans/subnets.

Matter devices don't work across VLAN segments: You might get mDNS traffic to forward, however, link-local IPv6 addresses (starting with fe80..) which are most likely in use here can't travel across VLANs by design: They are link-local.

You need to have the Matter device, your phone as well as the Matter server in the same network to make things work.

[pbean]

The network has IPv6 addresses and IPv4. HA has there one assigned. I have a fortigate firewall and I enabled multicast-forwarding and setup multicast ipv6 routing policies for my vlans. I even setup avahi and configured it as well and it sees all the multicast traffic from all my devices on the network just fine as well and has interfaces setup and configured on both vlans/subnets.

Matter devices don't work across VLAN segments: You might get mDNS traffic to forward, however, link-local IPv6 addresses (starting with fe80..) which are most likely in use here can't travel across VLANs by design: They are link-local.

You need to have the Matter device, your phone as well as the Matter server in the same network to make things work.

I do apologize but that is incorrect. The phone has to be on the same network as the one you want the matter device to be on when joining the device to homeassistant and that is it. The doc's state that it may not integrate well but Im watching my tapo plugs joined to homeassistant via the apple ios app turn off and on without any problem or hesitation via the homeassistant portal from my computer as I type. The power on the plug itself is indicated by a blue led coming from the button and its turning off and on as I click the toggle. Theres also a very distinctive click on the devices when I do this too. Ive included a screenshot of the first one's device details I tested this morning. You can clearly see it has its own ipv6 address(it also has an ipv4 address and a link local ipv6) Homeassistant is on one vlan, the tapo plug is on another, even my computer is on a third different vlan(not that it matters)

[agners]

Weeell, of course things are more complicated. The Android API only gives us link-local addresses, so we send this to the server. This limitation requires the Android phone running our App and the Matter Server to be on the same network (or rather, Home Assistant needs to consider the same network as primary network). How do I know? I wrote the code 🙈

I've documented my findings also in home-assistant-libs/python-matter-server#463 (comment).

That said, ideally we'd get a full setup code and do a discovery for commissionable Matter devices on Server side again, this would work across various network configurations. That is actually how things work in Apple land. At least last time I checked the Android Matter SDK did not had that capability 😔.

[pbean]

ah I see now. That's a bummer for android only users :( Thank you for this, that gives a real answer as to why it was not working yet still finding the node. It answers the broadcast so the node is known but android forwards the link local ip as the nodes actual ipv6 address rather than the real one so the pairing is initiated on a link local it can't route to on the other vlan so the process fails/times out waiting for a response in the black hole.

[pbean]

So I'll go ahead and close this and note I updated the issue report on the android side. I even did some research and offered a possible way that might work to get this functionality. However, like I state in my comment I haven't worked on android or java in over a decade so it's just something I tossed around with the AI. home-assistant/android#5433 (comment)