Switchport voice vlan + tagged traffic

[John McNumara]

I configured switchport voice vlan on our access switches for a phone vendor, whose phones support CDP.  They manually configured the VLAN ID on every phone anyway.  However, it is working. 

My question is, if I issue the switchport voice vlan vlan-id command on a switchport that is already receiving tagged frames from a phone, is it working because the frames are tagged with the same vlan-id used in the command, or because of CDP?  The reason I ask this, is because show cdp neighbor is not showing any phones.

Thank you

[Peter Paluch · Accepted solution]

John,

My question is, if I issue the switchport voice vlan vlan-id command on a switchport that is already receiving tagged frames from a  phone, is it working because the frames are tagged with the same vlan-id  used in the command, or because of CDP?

The first option is correct - the port accepts tagged frames because their VLAN ID matches the VLAN specified in the spanning-tree voice vlan vlan-id command.

CDP has primarily an informational function on ports with voice VLAN - it instructs the phone to use the specified VLAN, optionally it can also instruct it to rewrite 802.1p CoS markings in frames received from PC (if the switchport priority extend cos command is used). Should the device trust be activated using the mls qos trust device command, the presence of the phone detected via CDP is necessary for the port start trusting the ingress QoS markings.

Best regards,

Peter

[John McNumara]

Does the phone need to be detected by CDP if using the command mls qos trust cos?

Also, as CDP is not detecting the phones, is there any benifit to using switchport voice vlan with the spanning-tree portfast command versus trunking the port and using the spanning-tree portfast trunk command?

[Peter Paluch]

Hi John,

Does the phone need to be detected by CDP if using the command mls qos trust cos?

If using mlq qos trust device cisco-phone command in particular then yes - the IP phone has to be detected via CDP. The mls qos trust cos command alone does not depend on CDP and detecting the phone; it merely activates unconditional trust on the CoS markings. It can be used with conjunction with the mls qos trust device cisco-phone command to make the trust conditionally active only when an IP phone is detected via CDP.

is there any benifit to using switchport voice vlan with the  spanning-tree portfast command versus trunking the port and using the spanning-tree portfast trunk command?

Old switches (2900XL and similar) were indeed configured as trunks because the switchport voice vlan only caused the CDP to advertise the voice VLAN but it did not allow the port to send and receive tagged frames in the voice VLAN. With today's switches, the switchport voice vlan also configures the port automatically as a "mini-trunk" with only two allowed VLANs: the access VLAN operating in native mode, and the voice VLAN operating in tagged mode. If you wanted to configure your port as a trunk, you would need to redefine the native VLAN and modify the allowed VLAN list so that no more VLANs are allowed on the trunk. Also, this port would be eligible to carry DTP and VTP messages, something that access ports do not do for security reasons. So even though you can achieve the same functionality using a manually configured trunk, the switchport voice vlan is easier to handle.

By the way, configuring the voice VLAN on a port using switchport voice vlan also activates PortFast automatically.

Best regards,

Peter

[John McNumara]

Thank you Peter, you gave a perfect explanation