Voice vlan voice traffic only

[AlanGill92533]

I have a panasonic voip phone I want to make sure that someone cannot just remove the data cable from the phone and plug it into their computer and join my network. All I want is voice traffic to work on port/cable. Any help with configuration on the Cisco  switch catalist 1000 series would be much appreciated. Thanks in advance. Al 

[balaji.bandi · Accepted solution]

Not sure if you have any Identiy system in place like ISE to identify the device and validate.

Quick fix is sticky MAC.

if you add the stick MAC to port, then only with the source MAC only the port works, if not that will go error disable ( you can also configure auto recovery)

below example : check the command syntax based on the IOS code.

(config)# interface gig x/x
(config-if)# switchport mode access
(config-if)# switchport access X (this is voice vlan or you can use voice vlan)
(config-if)# switchport port-security
(config-if)# switchport port-security mac-address sticky
config-if)# switchport port-security mac-address xxxx.xxxx.xxxx(Static MAC of Phone)

[AlanGill92533 · Accepted solution]

Yes 100% thank you . Makes perfect sense. Excellent thanks again

[MHM Cisco World]

L2 port-security not know that device is IP phone or PC, 
and if you use sticky then if you move device to other port you will get err-disable and that for 500 users is nightmare, 
I think the best is dot1x if you can or using MAC ACL, 
MAC ACL with range of mac can you protect the port. 
this my view.