Network setup for Voice and other VLANs?

[vonkempnz]

I have spent several days tearing my hair out trying to properly configure our small business switch (SG300-10p) for voice. The phones are a relatively new addition and will replace old POTS phones.

Our network consists of a 1941 ISR router, the SG300-10P switch, a mac server (handing DHCP, DNS, AFP), 4 client desktops and 4 SGA525G2 IP phones. The router, server, desktops and phones all have their own connection to the switch and the second data ports on the back of the IP phones are not used. We do not have any unified comms devices for voice. Our VOIP solution is hosted by a local SIP provider, and each phone independently registers with the provider's SIP proxy over the internet.

Left almost to it’s own devices (or presumably flat, default settings on VLAN 1), this whole setup works just great. We can TFTP files, make and receive calls, and do all the usual XML stuff. Calls are crystal clear. Even the localisation and directory works. However, I’ve been told several times that to ensure good quality on VOIP calls during periods of busy traffic, I should set up some form of QoS. A Voice VLAN on the switch, I was told, is the best way to do this as it automagically gives priority to the whole voice VLAN over the normal data VLAN.

I have followed instructions in numerous manuals, articles and guides, and have managed to create the Voice VLAN, both manually and automatically (I can watch Smartport detect the phones and see the Auto Voice VLAN add the ports to the VLAN as I connect them). The trouble is, as soon as this happens, the phones lose connectivity with the rest of the network, including the DNS server and the router, and therefore the internet, causing them to lose registration with the SIP service.

I tried adding the server and router ports to the Voice VLAN and tweaking every possible combination of tagged, untagged, excluded, trunk, access, general and PVID settings I can think of (by the way, I have no idea what any of those mean). The switch is in Layer 2 mode, but adding the port connected to the router to all the VLANs does not result in internet connectivity to the phones. I have told the phones to tag frames with the VLAN ID and told them not to. I have tried upgrading firmware and I have rebooted the switch so many times I'm tired of those wretched little flashing lights.

Nothing seems to work. And so I am stuck with everything on VLAN 1. My most recent thought is that the 1941 needs to know about the Voice VLAN (I checked CDP and it knows about the switch), but I’m reluctant to start messing with the router config when this is our production network, at least without knowing what I'm doing. I don’t even know if QoS applies when a Voice VLAN is not set up and we're on VLAN 1, some articles say yes, others say no. And when it is set up right, how does that priority transfer to the router? I’ve looked in the router manual and config options and found something called 802.1Q, but I have no idea what it is, how it works or even if it applies to our situation. Can I forgo VLANs altogether and use QoS some other way, perhaps?

Can anyone please help? I need step-by-step instructions. I’m not a networking guy, but I have googled enough to cobble together our setup in IOS up until now. Ideally, I would still like to be able to ssh or https into each device (as I do now) for management, and I’ve read about setting up a another VLAN for config, monitoring etc, but I guess that would mean routing between VLANs in Layer 3.

Thanks in advance,

[Gregory Snipes · Accepted solution]

Correct me if I am wrong Nick, but it sounds like you have not configured a sub-interface on the router for the new VLAN.

If this is the case I can certainly help you get that up and running. However, please note that in your setup you probably do not need QOS. In fact I ran a network that had over 2000 phones for years with no QOS, without any issues. QOS really becomes important when you have highly utilized links (typically WAN links) that you need to pass the voice traffic over. Are you actually having issues with call quality, or are you just following recommended practices here?

[vonkempnz]

Thanks for the tip! I’ve done a bit more reading a fiddling about in the last 24 hours based on your suggestion and I think I have it sorted. Here’s what I did:

I temporarily shut down the WAN interface on the 1941 and set up a couple of sub-interfaces for the data (10) and voice (20) VLANs:

!

interface GigabitEthernet0/1

no ip address

duplex auto

speed auto

no mop enabled

!

interface GigabitEthernet0/1.10

description INTERNAL DATA VLAN

encapsulation dot1Q 10 native

ip address 10.10.0.10 255.255.255.0

ip nat inside

ip virtual-reassembly in

!

interface GigabitEthernet0/1.20

description INTERNAL VOICE VLAN

encapsulation dot1Q 20

ip address 10.20.0.10 255.255.255.0

ip helper-address 10.10.0.30

ip nat inside

ip virtual-reassembly in

I then created corresponding data (10) and voice (20) VLANs on the SG300-10P. I also moved all ports off VLAN 1, set the switch’s admin VLAN to 10 and turned off smartport (I did some of this via the GUI and some on the CLI) (edited for brevity):

!

vlan database

vlan 10,20

voice vlan id 20

!

interface vlan 1

no ip address dhcp

!

interface vlan 10

name Data

ip address 10.10.0.20 255.255.255.0

!

interface vlan 20

name Voice

!

interface gigabitethernet1

switchport mode access

switchport access vlan 10

...

interface gigabitethernet5

switchport mode access

switchport access vlan 20

...

interface gigabitethernet10

switchport trunk allowed vlan add 20

switchport trunk native vlan 10

!

macro auto disabled

!

ip default-gateway 10.10.0.10

ip name-server  10.10.0.30

This seems to work very well, although I did run into a few other problems along the way:

1. I had to add another ACL rule to the router so it could NAT the Voice VLAN (20) traffic to the internet and let the phones register with the SIP proxy. I fixed that with:

ip nat inside source list 101 interface GigabitEthernet0/0 overload

!

access-list 101 permit ip 10.10.0.0 0.0.0.255 any

access-list 101 permit ip 10.20.0.0 0.0.0.255 any

I had a to go back to the router’s usb console at one point because after clearing all the access-lists and re-entering the SSH entries, I couldn’t connect via SSH. Turns out ACLs are hierarchical. Makes sense, and is quite clear when doing a “show access-lists”, but not so clear from the running-config.

2. The phones could not reach the DHCP server and would not get IPs in the right range, so I got it working with static IPs, then created a new DHCP pool on the server (dishing out 10.20.0.x) and messed about with something called DHCP relay and helper addresses until it worked. I think this just passes DHCP broadcasts from the phones across the sub-interfaces, but I might be wrong.

interface GigabitEthernet0/1.20

ip helper-address 10.10.0.30

3. I was expecting the phones to be unable to find the DNS server because it’s on the Data VLAN (10), but it just worked. I read that routers can do something called interVLAN routing, so perhaps it is routing across sub-interfaces, which enables the phones resolve name requests.

Anyway, I put all that together and it seems to work great. Any comments or suggestions most welcome.

Thanks for the clarification about QoS too. I guess the whole setup is total overkill in our (very small) case and I’m making problems for myself, but I like to do things right and understand at least a little about how they work in the process.

Nick