Benefit of Voice VLAN Definition

[ronbuchalski]

What is the benefit of defining a voice vlan for a port, versus defining a port as a trunk, trunking two vlans (native vlan for the PC, second vlan for voice)?

The Avaya phones I am working with get configured with dot1q trunks and a vlan to use for voice, via DHCP Option 176. The PCs do not know anything about trunking, and send untagged frames to the port which go into the native vlan defined for the port.

Why define a voice vlan? Is this for an all-Cisco environment only? Does the Cisco IP phone learn about the voice vlan via CDP from the switch?

I searched the docs, but couldn't find a definitive answer. What we have configured works today, without a voice vlan defined. See below (from a 2950G):

interface FastEthernet0/1

switchport access vlan 7

switchport trunk native vlan 7

switchport mode trunk

switchport nonegotiate

switchport priority extend trust

no logging event link-status

mls qos trust dscp

no cdp enable

spanning-tree portfast

With this port config, the untagged PC data frames use VLAN 7 (native vlan), and the phone tags it's frames with another vlan (defined in Option 176).

[fred.s.mollenkopf · Accepted solution]

Ron,

Cisco uses CDP to determine the VLAN used for Voice traffic, aka the Voice VLAN. To my knowledge Cisco phones don't currently support Option 176 to learn the vlan.

Of course the disadvantage of not having a Voice Vlan is from a security and QoS standpoint. Voice Vlans will allow for Acls to be crafted limiting the traffic to the phone as well as vlan based QoS policies that only affect the voice traffic if explicit trusting isn't used.

Please rate any helpful posts.

Thanks

Fred

[ronbuchalski]

Fred,

Thank you for your response. It is very helpful. To verify what you said, I connected my Wireshark analyzer to a Cat2950 switchport, and configured:

interface FastEthernet0/1

switchport trunk native vlan 2

switchport trunk allowed vlan 2,100

switchport mode trunk

switchport voice vlan 100

switchport priority extend trust

no logging event link-status

mls qos trust cos pass-through dscp

spanning-tree portfast

Sure enough, the CDP announcement contains an advertisement for Voice VLAN 100.

Thanks again for your help. You filled in the blanks for me.

Ron

[cybrsage]

Correct, the voice vlan is there for the Cisco phone to learn its VLAN number. It is only needed on Cisco phones.

[ronbuchalski]

Thank you for your reply. I posted my question to the Forum because I couldn't find this stated in the IOS documentation for Catalyst switches.

It appear that the documentation is written for an "all Cisco VOIP world".

Ron

[fred.s.mollenkopf]

Ron,

Thanks for rating the posts and the in-depth check with the packet analyzer. I was unaware of the TFTP Option 176 used by Avaya and it's worth the points in my opinion.

Welcome to the forum

Thanks

Fred

[kleo]

Be aware that avaya phones will also work with voice vlan commands(making life easier from a vlan pruning perspective on ports & uplinks) and not requiring explicit dot1q trunks, But you still have to do dhcp option 176 for native vlan to have phones jump to voice vlan, since avaya phones do not work with cdp.

I have many of my switch ports configured as follwing for my avaya phones:

Interface FastEthernet0/5

Description to Avaya IP phone and PC

switchport mode access

switchport access vlan 7

switchport voice vlan 100

no ip address

mls qos trust cos

spanning-tree portfast

Avaya phones do work with LLDP 802.1ab for voice vlan discovery, but cisco doesn't support this yet :-(

Also, the follwing statement does you no good with an avaya ip phone:

switchport priority extend trust

to get an avaya ip phone to re-write cos(which is what extend trust does) on 2nd ethernet port where pc is plugged into you need to add vlansep=1,phy2prio=0 in dhcp option 176 or set phy2prio 0 in 46xxsettings file.

more information located here:

http://support.avaya.com/elmodocs2/4600/233507_4.pdf

[ronbuchalski]

Thank you for posting this excellent information. It is very useful.

Our current Option 176 information includes:

option 176 ascii "mcipadd=aa.bb.cc.dd,mcport=1719,l2q=1,l2qvlan=88,tftpsrvr=ww.xx.yy.zz"

l2q=1 tells the phone that it will operate with a dot1q trunk

l2qvlan=88 tells the phone that vlan 88 is the voice vlan

If a switchport is configured as an access port with a voice vlan, is the l2q=1 parameter no longer necessary?

I have two further questions:

1) What is the difference between a port configured as access, with a voice vlan and native (data) vlan, versus a port configured as trunk, with a vlan for voice and the native vlan for data?

It would seem to me that, unless the port is operating as a trunk, and the telephone is tagging voice frames with the native vlan tag, that the switch port will not know the difference between voice and data frames entering the port.

2) Does a switchport configured with a voice vlan and native vlan essentially operate implicitly as a dot1q trunk, with only two active vlans (native and voice)?

Thanks again,

-rb

[ronbuchalski]

To clarify my terminology:

In questions 1 and 2, where I used the word 'native', what I meant was the access or assigned vlan for the port. I know that using the word 'native' implies the use of a dot1q trunk.

Sorry for the confusion.

-rb

[kleo]

2) Does a switchport configured with a voice vlan and native vlan essentially operate implicitly as a dot1q trunk, with only two active vlans (native and voice)?

Yes, that the way it works!

and you still need L2Q=1

Your native or data vlan should ONLY include:

l2q=1,l2qvlan=88

and your voice vlan scope should look like this:(no l2q statements)

mcipadd=aa.bb.cc.dd,mcport=1719,tftpsrvr=ww.xx.yy.zz

[ronbuchalski]

Kleo,

I am not clear on your last comments.

l2q=1 is carried within Option 176 and tells the Avaya phone that it's connection will operate as an 802.1q trunk. l2q=0 is default (no 802.1q trunk).

Are you confusing this with VLAN 1 on a trunk?

Also, in your last statement, you indicate that the DHCP scope should not include any l2q statements, which contradicts what you say just above it, where you indicate still needing to use lq2=1 and l2qvlan=88.

Please clarify.

Thanks,

-rb

[kleo]

Let me clarify the whole process start to finish:

The following occurs when an avaya IP telephone is installed or manually cleared. The IP telephone will initially send an untagged DHCP request.

The data switch port is configured with both an untagged VLAN and tagged VLAN for the port.The untagged DHCP request will be associated with the untagged VLAN on the port. Example: the router interface on that VLAN has IP address 178.16.13.1. When the router interface relays the DHCP request to the configured DHCP server (178.16.13.66), it will use 178.16.13.1 as the source address. The DHCP server associates this request with the 178.16.13.0 scope and returns a reply with Option 176 string set, instructing the requestor to enable 802.1Q tagging(L2Q=1) with voice VLAN ID 88(L2QVLAN=88). The IP telephone receiving this reply will release(DHCPRELEASE) the supplied IP address, reset and issue a new DHCP request with VLAN ID 88. This request will be associated with the tagged VLAN on the port. The interface of this VLAN has IP address 178.16.12.1 and will relay the DHCP request to the DHCP server with this address as the source. The DHCP server associates this address with scope 178.16.12.0 and replies with an IP address from that scope as well as several parameters in the Option 176 string. Computers attached to the Avaya IP telephones issue untagged DHCP requests. These requests will be serviced the same as the initial request from the phone. However, the computer will ignore the Option 176 values specifying a new VLAN. Therefore, no new DHCP request is issued.

DHCP Option 176 Examples:

Native Vlan (Data/PC vlan) - Option 176 needs to be added to Native Vlan DHCP scope

with these settings:

L2Q=1,L2QVLAN=88

Tagged Vlan 88(IP Phone/voice vlan). Option 176 needs to be added to Tagged Vlan DHCP scope with these settings:(the phone at this point has vlan 88 and l2q=1 retained in flash mem)

MCIPADD=X.X.X.X,MCPORT=1719,HTTPSRVR=X.X.X.X

Also FYI, if avaya ip phone is reset, it doesn't have to go through this whole process again, since it retains the voice vlan in flash, but if moved to another vlan it will revert back to native vlan(and start the process) after 60 seconds of trying to locate the dhcp server in tagged voice vlan it last remembered.

[ronbuchalski]

Kleo,

Thanks for the clarification. I already understood the process that Avaya phones follow to get onto the network (read it in the Avaya docs, as well as discussed it with the IPT engineers here).

What I was unclear about from your previous message was that you were saying the Option 176 info for the _voice_vlan_ dhcp scope does not need to include l2q=1 and l2qvlan=88. The phone retains this from its' initial dhcp exchange.

Given all this, I have one final question:

What happens if the voice vlan dhcp scope DOES include l2q=1 and l2qvlan=88? Will the Avaya phone ignore it (since it already has this info), or will it actually cause the phone to go through additional processes to complete the address assignment process?

Again, thank you for posting such useful information to this forum. I trust that it will also prove useful to others, well into the future.

-rb

[kleo · Accepted solution]

it can cause a looping condition in some instance.Phone will display error. I think newer avaya phone firmware though ignores any new l2q statements if one is in flash already.

[ronbuchalski]

Kleo,

Thanks again for your feedback. This explains some of the strange behavior we occasionally see with our phone network.

-rb