cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3242
Views
35
Helpful
14
Replies

Can you send a different VLAN to the computer attached to a VoIP phone

InquiringTech
Level 1
Level 1

Say your voice VLAN is 65, but your main data VLAN is 64. Can you configure a switchport in trunking mode so that the phone gets on the voice VLAN 65 as needed but the computer it is daisy-chained to gets the main data/access VLAN, in this case 64? Would there have to be extra configuration done on the phone itself for this to work?

Also, when our equipment came set up from another branch office, I noticed our switchports designated for voice are all in the voice VLAN 65 as expected, but also in the default VLAN 1 (as an access VLAN). The switchports are set to be dynamic auto rather than access ports though from the 'sh int switchport' command. But this isn't a good idea to use VLAN 1 for the default one, right? Also, if we wanted to be able to push the data VLAN 64 to daisy-chained devices behind the phones, then THAT would have to be the access VLAN on those switchports rather than 1 right? Or is VLAN 1 just used as the native here? Bit confused. I don't want to ask the one who configured it until I get more info on this; I'm new to the voice aspect of Cisco routing.

Thanks.

1 Accepted Solution

Accepted Solutions

"Anyway, so to clarify, native VLANs are set on a per-port basis? Meaning there can be a different native VLAN for each port? I was just using Balaji's example, who indicated to use 64 for the access VLAN, but based on what you say, anything other than the voice VLAN would be untagged so it wouldn't be necessary to specify that anyway."

Again, "native" is used when working with a Cisco trunk port's untagged frames VLAN, which is either VLAN 1, by default, unless you specify another VLAN to be the "native" VLAN.

On access ports, they, generally don't use tagged (excluding the "voice" option) and also default to be in VLAN 1 unless configured to be part of another VLAN.

Each different trunk port, and each different access port, can be assigned a VLAN, different from the default VLAN 1, to be the "native" (untagged) VLAN, on a trunk port. or for the VLAN to be used by an access port.

A "voice" VLAN is an option (on many Cisco switches) where you can specify an additional VLAN to also use on an access port.  (By default, Cisco trunk ports carry all known VLANs).  Since a "voice" VLAN (on an access port) is an optional/second VLAN, we need to always explicitly define what VLAN is to be used for the voice VLAN on each access port (using that option).  Also since an access port using the optional voice VLAN, to distinguish that VLAN's frames from the non-voice VLAN frames, the voice VLAN frames are always tagged.  (Again, on an access port, the optional voice VLAN doesn't need to be an actual voice VLAN, but that what it's used for [possibly] 99.99999% of the time; so hence it's named to represent it usual usage.)

DHCP is done per subnet, which is often tied to a particular VLAN.  If there's no DHCP server with a "foot" in the subnet/VLAN, you need to use a helper function to redirect DHCP requests to the server. (Oh, and whether the server has a "foot" in the subnet/VLAN, or it's elsewhere in the network, it needs to be configured to support the IP address pool for the network, and have an available IP for the host device.  From basic DHCP IP assignment, a host is a host, doesn't matter whether PC or VoIP phone or . . .)

The option string I mention, is when a DHCP server sends an IP offer to a host, it can also sent additional information, like, don't use the network you're on now, switch to VLAN # (and DHCP for another IP).

For an example DHCP approach, you activate VoIP phone and PC connected to access port assigned to VLAN 64 and an optional voice VLAN of 65.  Both devices get an IP in whatever network is on VLAN 64.  However, VoIP phone "sees" the additional information that basically says, if you're a VoIP phone, switch to using tagged frames for VLAN 65.  When VoIP switches to tagged VLAN 65 frames, again it acquires another DHCP IP, but for network supporting VLAN 65.

The prior approach, requires good coordination with DHCP and port/VLAN assignments.  Also again, this is just one of the ways some VoIP phones can use a second tagged frame VLAN for themselves.

"I'm looking at the settings of the phone that is hung up registering (which are still accessible), and in Ethernet setup I see the Operation VLAN ID is 65, the Admin VLAN ID is blank, and the PC VLAN field is also blank but greyed out."

Okay, for your VoIP phones, I would presume such a configuration configures the phone to use tagged frames for VLAN 65, for itself.  I'm guessing PC VLAN field is greyed out, as likely expectation is only untagged frames will be used for non VoIP traffic.

What you need to insure, for such a configured phone, that the port is configured to pass the phone both tagged and untagged frames, the former being tagged for VLAN 65.  Further, whatever network VLAN 65 is using, host IP address, gateway IP, available IP to provide to host, all need to be as they should.  (Do I recall, DHCP something also needs to provide call management server's IP to VoIP phones?)

When you work with VoIP phones, rabbit hole can get deeper, like whether there's other VoIP infrastructure limitations not being correctly managed.

View solution in original post

14 Replies 14

balaji.bandi
Hall of Fame
Hall of Fame

If you have vlan create VLAN 64 and VLAN 65

One the Access port you look to the Phone and behind that PC ( this is basic config, you can add more features like portfast, security so on)

VLAN 64, 65
interface GigabitEthernet 1/0/1
switchport mode access
cdp enable ( if none cisco phone required LLDP)
switchport mode access
switchport access vlan 64
switchport voice vlan 65

For reference  good explanation :

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/54sg/configuration/guide/config/voice.html
#show interfaces gig 1/0/1 switchport

you will see Acces mode vlan :65
Voice vlan 64

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Joseph W. Doherty
Hall of Fame
Hall of Fame

"Say your voice VLAN is 65, but your main data VLAN is 64. Can you configure a switchport in trunking mode so that the phone gets on the voice VLAN 65 as needed but the computer it is daisy-chained to gets the main data/access VLAN, in this case 64?"

Yes, you can, but in non-ancient switches, you can configure a "lobotomized" trunk port or "enhanced" access port to support two VLANs.  @balaji.bandi's posting shows the later such configuration for this kind of port.

"Would there have to be extra configuration done on the phone itself for this to work?"

Depends on the VoIP phone.

"But this isn't a good idea to use VLAN 1 for the default one, right?"

Correct, because Cisco has other "stuff" that uses VLAN 1.  So, to better protect that "stuff", recommendation is to not use VLAN 1 as a "normal" VLAN.

"Also, if we wanted to be able to push the data VLAN 64 to daisy-chained devices behind the phones, then THAT would have to be the access VLAN on those switchports rather than 1 right?"

No, but also VoIP phones, as far as I know, don't "push" tagged frames past them, nor expect the non voice VLAN's frames to use tagged frames.  I.e. "data" frames, I believe, would be expected to be untagged, and if so, really doesn't matter what VLAN is being used.

"Or is VLAN 1 just used as the native here?"

In your example, yes, likely VLAN 1 is native (i.e. untagged).  However, BTW, "native", explicitly, only applies to Cisco ports configured as trunks.  Are the ports actually configured as trunks or as Balaji shows?

Also BTW, recently I posted to a thread where several didn't, I believe, fully understand the nuances of access ports of the kind Balaji posted a config for.  (I.e. believe some of the statements, made by other posters, were/are incorrect [including in the selected "solution"].)  So, I provided a Packet Tracer example showing connecting a data/voice access port with a trunk port, and that they can pass data back and forth both tagged and untagged (and contained by VLANs).  See Voice VLAN traffic through access ports.

Thanks that clears some things up, but I'm a bit confused about the native VLAN here. You're saying that aside from the voice VLAN, the only other VLAN that can be allowed on this kind of unique/limited trunk port is the native one (thus untagged)? As I said we use 64 for our data, and that's what I would want the computer behind the phone to get... but you say it doesn't matter as long as it's untagged since that applies to everything? And VLAN 1 isn't really used much in our switch except as the default and in this case I guess native, since that wasn't changed. The only ports it is present on are the ports going to the VoIP phones.

The reason I ask is because each of these VLANs, with SVIs, is tied to a different subnet, with its own DHCP pool. So the voice subnet is 192.168.65.x and the data 192.168.64.x, etc. Is there a way to get the computer behind a phone on the correct VLAN and subnet in this fashion? While the phone also stays on its respective voice one?

"Are the ports actually configured as trunks or as Balaji shows?"

I saw that the word trunk didn't actually appear in the config or commands entered in his post (as in 'switchport mode trunk'), but essentially adding that voice vlan makes it a special kind of trunk, right? As I mentioned, right now they are in dynamic auto mode, which I guess means it can convert to a trunk link if the neighboring device is set to trunk or desirable... but in this case it's a phone (btw I'm using CP-8851 as an example here).

Have you tried that example posted about  ?

that is the standard setup used all over if the Cisco Phone CDP is good enough.

Sure Voice Phone get Voice VLAN, and Data PC gets Data VLAN as per the example.

You can test one port before you deploy in mass to understand is this working.

If you have Voice VLAN interface vlan X - make sure add ip-helper to get IP address, same way Data VLAN too (if the switch not handling the DHCP)

Any issue post the config you were configured and what was the outcome to troubleshoot with you.

 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

I tried it but the phone seemed to be stuck in 'Detecting network' for a long while, and has now been in 'Phone is registering' for like over 20 minutes... might be something else impacting it.

But it didn't used to take this long.

Name: Gi3/0/14
Switchport: Enabled
Administrative Mode: static access
Operational Mode: down
Administrative Trunking Encapsulation: dot1q
Negotiation of Trunking: Off
Access Mode VLAN: 64 (VLAN0064)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: disabled
Voice VLAN: 65 (VLAN0065)
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk associations: none
Administrative private-vlan trunk mappings: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL

I dont see wrong in your config, 
please share the show cdp neighbor, 

Thanks, this ended up working eventually!

Okay, let's cover some basics as your note you're "new" to VoIP.

For a switch that supports VLANs, we need some way to separate frames into different VLANs.  There are a few ways to do this, the most common being, you assign a port to a VLAN.  Frames going in/out that port look just like any other similar port's frames, but the switch logically segregates the frames.  For example, frames using ports 5 and 6 in VLAN 10 are not shared/intermingled with frames using ports 15 and 16, if those ports are defined to be in VLAN 20.  However, of course, fames using ports 5 and 6, or ports 15 and 16, can be shared/intermingled for ports in the same VLAN.  Again, frames going in/out these 4 ports, look "alike".

If you wanted to "share" VLANs 10 and 20 with another switch, keeping those VLANs separated, you might connect port 5 or 6 to another switch's port 10, if port 10 is also defined to be VLAN 10.  Likewise, port 15 or 16 might be connected to port 20, on the other switch, if port 20 is defined to be in VLAN 20.  Still, you cannot distinguish between VLAN 10 and VLAN 20 frames, looking at just the frames.

Using a port per VLAN to interconnect switches isn't very "nice" as you create more and more VLANs.  So, we define a way to tag frames with their VLAN ID, and since frames can now be distinguished they can be sent in/out the same port, which Cisco calls a trunk port.  Cisco's trunk ports allow you to work with any one single VLAN's frames without tags, which you configure as the "native" ("native" as its looks the same as any other untagged frame).  Basically, the "native" VLAN assigns untagged frames to use a particular VLAN the same as an access port assigns untagged frames to a particular VLAN.  The big difference, a trunk port can send other VLANs in/out the same port, as they will be tagged with a VLAN ID.

Basically, most modern VoIP phones have built-in "special/limited" VLAN capable switch.

Above, I mentioned how two switches could share multiple VLANs on the same port if the frames were tagged.  In Cisco's trunk implementation, you can also mix a single untagged set of frames, with the other tagged frames, because you configure the switch to assign untagged frames to a particular VLAN.

A VoIP phones, it designed like this too, although it only supports two VLANs, one untagged and one tagged.

Such a phone can interoperate with a Cisco trunk port, also configured to use just one untagged VLAN (native), and one tagged VLAN.  Since such a VoIP phone is limited to two VLANs, again, untagged and tagged, Cisco created an option for access ports to support one additional VLAN, tagged, in addition to their already untagged VLAN (this to avoid using a Cisco trunk port, for the same purpose - which, before there were access ports with "voice" VLANs, was how it could be done).

Cisco's implementation "names" the tagged VLAN "voice", because that's generally what it's always used for, but the switch port really doesn't care.  All it cares about is that you assigned one VLAN for untagged frames (classical access port - and much like a trunk port's native assignment) and one VLAN for tagged frames (unlike a trunk port, as they, by default, carry all VLANs known on the switch, but can be restricted to just one VLAN).

So, what my prior reference to another thread showed, from a VLAN and frame tagging perspective, an access port defined with a "voice" VLAN is very much like a trunk port using just two VLANs, one of which is "native" or untagged (actually there are other differences too, dealing with "control", but for "our traffic", they don't normally matter).

This is why I mention, VLAN 1, 64, 65, etc., doesn't matter.  You determine what your VLANs are, how they are to be used, and, as they use the port, whether frames are tagged for not.

BTW, another way to setup up VoIP phones, is they and your PCs, each, have their own port connections.  Sharing a port, like a trunk, vs. one per, between switches, for each VLAN, just reduces edge port requirements.

Further, whether VoIP phones share a port with a PC, or have their own ports, you can have VoIP phones with their own VLAN or they can share a VLAN with PCs.

I.e. you can mix and match shared VLANs vs. separate VLANs for VoIP phones and PCs along with VoIP phones and PCs having separate edge ports vs. sharing an edge port.

As a VoIP phone's built-in "special/limited" VLAN switch (to my knowledge) always uses untagged frames for downstream devices.  Further, if the VoIP phone is also using tagged frames (to my knowledge) it always used for the VoIP phone, itself.  Again, it's up to you configure your edge port as desired, i.e. whether to use only untagged frames or untagged and tagged, and VLAN assignments for what you're using.

As to VoIP phone "knowing" whether to use tagged frames for themselves, and if so, what the VLAN tags should be, that varies a bit by brand of VoIP phone and/or configuration options on the phone.  For example, VoIP phone might use CDP and/or LLDP to determine if edge port is providing a tagged VLAN, and if it does, VoIP phones assumes it's for exclusive use of the phone.  Or, phone might be "hard coded" to use a particular VLAN tagged frames.  Or, phone might get a DHCP option string which indicates it should use a particular tagged VLAN ID for its traffic.

Hopefully, the above might help you better understand how VoIP phones use untagged or tagged frames.

If you have questions on the above, feel free to post them.

Thanks Joseph, that does explain a lot more. I had some prior limited exposure to VoIP systems that were non-Cisco (Polycom), but the configurations were all very basic and had more to do with settings on the phones themselves rather than the networking aspects.

Anyway, so to clarify, native VLANs are set on a per-port basis? Meaning there can be a different native VLAN for each port? I was just using Balaji's example, who indicated to use 64 for the access VLAN, but based on what you say, anything other than the voice VLAN would be untagged so it wouldn't be necessary to specify that anyway.

The other thing was about DHCP and subnets: would it find its way to the right DHCP pool from the configuration of that switch edge port? Even if 64 wasn't specified and it was all untagged aside from the voice one? How would it know otherwise? Because we have other subnets aside from just voice that need to be differentiated. Could you maybe elaborate a little more on this option string?

Before trying this configuration, the computer attached to the phone would always just get the same VLAN as the phone (65) and be in that subnet/pool, although that is the voice subnet, which we don't want.

Now it just isn't registering and hanging up on the port I'm testing with, but I'll try to troubleshoot it more and compare what's different from the other ports that do work.

I'm looking at the settings of the phone that is hung up registering (which are still accessible), and in Ethernet setup I see the Operation VLAN ID is 65, the Admin VLAN ID is blank, and the PC VLAN field is also blank but greyed out.

"Anyway, so to clarify, native VLANs are set on a per-port basis? Meaning there can be a different native VLAN for each port? I was just using Balaji's example, who indicated to use 64 for the access VLAN, but based on what you say, anything other than the voice VLAN would be untagged so it wouldn't be necessary to specify that anyway."

Again, "native" is used when working with a Cisco trunk port's untagged frames VLAN, which is either VLAN 1, by default, unless you specify another VLAN to be the "native" VLAN.

On access ports, they, generally don't use tagged (excluding the "voice" option) and also default to be in VLAN 1 unless configured to be part of another VLAN.

Each different trunk port, and each different access port, can be assigned a VLAN, different from the default VLAN 1, to be the "native" (untagged) VLAN, on a trunk port. or for the VLAN to be used by an access port.

A "voice" VLAN is an option (on many Cisco switches) where you can specify an additional VLAN to also use on an access port.  (By default, Cisco trunk ports carry all known VLANs).  Since a "voice" VLAN (on an access port) is an optional/second VLAN, we need to always explicitly define what VLAN is to be used for the voice VLAN on each access port (using that option).  Also since an access port using the optional voice VLAN, to distinguish that VLAN's frames from the non-voice VLAN frames, the voice VLAN frames are always tagged.  (Again, on an access port, the optional voice VLAN doesn't need to be an actual voice VLAN, but that what it's used for [possibly] 99.99999% of the time; so hence it's named to represent it usual usage.)

DHCP is done per subnet, which is often tied to a particular VLAN.  If there's no DHCP server with a "foot" in the subnet/VLAN, you need to use a helper function to redirect DHCP requests to the server. (Oh, and whether the server has a "foot" in the subnet/VLAN, or it's elsewhere in the network, it needs to be configured to support the IP address pool for the network, and have an available IP for the host device.  From basic DHCP IP assignment, a host is a host, doesn't matter whether PC or VoIP phone or . . .)

The option string I mention, is when a DHCP server sends an IP offer to a host, it can also sent additional information, like, don't use the network you're on now, switch to VLAN # (and DHCP for another IP).

For an example DHCP approach, you activate VoIP phone and PC connected to access port assigned to VLAN 64 and an optional voice VLAN of 65.  Both devices get an IP in whatever network is on VLAN 64.  However, VoIP phone "sees" the additional information that basically says, if you're a VoIP phone, switch to using tagged frames for VLAN 65.  When VoIP switches to tagged VLAN 65 frames, again it acquires another DHCP IP, but for network supporting VLAN 65.

The prior approach, requires good coordination with DHCP and port/VLAN assignments.  Also again, this is just one of the ways some VoIP phones can use a second tagged frame VLAN for themselves.

"I'm looking at the settings of the phone that is hung up registering (which are still accessible), and in Ethernet setup I see the Operation VLAN ID is 65, the Admin VLAN ID is blank, and the PC VLAN field is also blank but greyed out."

Okay, for your VoIP phones, I would presume such a configuration configures the phone to use tagged frames for VLAN 65, for itself.  I'm guessing PC VLAN field is greyed out, as likely expectation is only untagged frames will be used for non VoIP traffic.

What you need to insure, for such a configured phone, that the port is configured to pass the phone both tagged and untagged frames, the former being tagged for VLAN 65.  Further, whatever network VLAN 65 is using, host IP address, gateway IP, available IP to provide to host, all need to be as they should.  (Do I recall, DHCP something also needs to provide call management server's IP to VoIP phones?)

When you work with VoIP phones, rabbit hole can get deeper, like whether there's other VoIP infrastructure limitations not being correctly managed.

OK after some more troubleshooting I found that for some reason DHCP was turned off on the phone, which I never did and they are usually not set that way. Then I still had some problems but after a while got it to work. The phone is in its VLAN and respective subnet while the computer is in its own, as intended. So essentially Balaji's commands did work ultimately. Just had to tweak some other things on the phone and switch in my case.

Thanks.

your Q return me to when I start study VoIP, 
any way 
there four config case you can use for Voice+data 
this link below explain these four cases 
https://ccie4all.wordpress.com/2013/04/27/confusion-about-voice-vlan/

BTW, @MHM Cisco World, just (very) quickly skimming your reference, the author is presenting, what I believe is incorrect information.

"I have been looking into this like a madman and must admit that Voice combined with QOS is not the easiest to understand."

Yea, so many seem to struggle with QoS.  I think the problem is the way QoS is presented.  This author still doesn't, I believe, really understand.

If you're interested, perhaps I'll detail the specific (what I believe) are errors.

check link I share it sure explain to you the use of trunk/tag/untag/VoiceVlan

Review Cisco Networking for a $25 gift card