Newbie ? on CM and VLANs..please be nice

[angel-moon]

Hello,

well I have to start somewhere so please forgive me if this question seems elementary.

I have seen mention of setting up VLANs for the IP phones and Call Manager servers where nothing else shares the VLAN. Could someone tell me why you would want to do this and what effect does that have when the computers are plugged into the phones which then are off in thier own seperate VLAN.

Thanks for any input and remember...you didn't always know it all, you were a newbie once just like me! :)

[CCampbell_2]

Hello,

What actually happens is an 802.1q trunk is created between the phone and the switch. A trunk allows more than one VLAN to be passed over a single connection. The phone listens to traffic in the voice VLAN and passes through the PC vlan to the port on the back of the phone that the PC plugs into.

[angel-moon]

OK...That explains the what but what about the why?

[Thomas.ott]

The Voice Vlans allow you to put QoS on the voice traffic so it gets delivery priority over data traffic. You also get flexibility to use your switchports for phones or PCs or to "daisy chain" by pluging in a PC to the PC port on the IP Phone. In addition to this there are also some security benefits. I suggest you read the Cisco Safe white paper IP Telephony Security in Depth.

[CCampbell_2]

Because we can. :) Seriously though, it's just a best practice kind of thing.

1. If we could limit the traffic our phones see and in the case of broadcasts, have to deal with, why shouldn't we, especially if it's easy enough to do.

In the PC/data world, broadcasts aren't really a big deal these days with the abundant amount of network bandwidth and PC processing power that we have, but my Cisco 7970 phone can barely keep up with displaying the Corporate Directory.

2. It makes it easy to apply ACLs to the VLAN interface for the voice environment should we choose to do so.

These are a couple of reasons, maybe someone else will chime in with a few. Basically, it just makes more sense to do it, than to not do it.

[droberts]

The main reason is security. Some people put ACL's or firewalls between the two VLAN's to restrict worm outbreaks.

Even without using voice vlans, QoS is enabled within the phone itself. Without any configuration on the switchport, (I believe) packets from the PC are tagged with the default DSCP/CoS while voice RTP (and perhaps SCCP) are tagged higher.