Course contents

Chapter 4: VLANs and TrunksLesson 6 of 18

Voice VLAN

A phone and a PC on one switch port: the voice VLAN, CDP and LLDP-MED, configuration and faults.

Intermediate · 10 min read

Technical definition

Voice VLAN is a VLAN reserved for IP phone traffic. On an access port with a voice VLAN configured, the switch tells the attached phone to tag its own frames with the voice VLAN ID, while a PC plugged into the phone sends untagged frames that stay in the port's data VLAN.

One socket, two devices

Offices run a single cable to each desk. A Cisco-style IP phone has a small built-in switch with a second port, so the PC plugs into the phone and the phone plugs into the wall. That gives a design problem: the phone and PC should sit in different networks. Voice traffic needs predictable delay and its own address range, and the PC should not be able to reach phone systems directly.

One switch port, two VLANs: the phone is tagged, the PC is not
One switch port, two VLANs: the phone is tagged, the PC is notA PC plugs into an IP phone and the phone plugs into switch port Gi1/0/5. The port is an access port in data VLAN 10 with voice VLAN 40. The phone sends its own frames tagged with VLAN 40, and passes the PC's frames through untagged, so the switch puts them in VLAN 10.PCVLAN 10IP phonebuilt-in switchSW1Gi1/0/5phone frames: tagged VLAN 40PC frames: untagged, VLAN 10interface Gi1/0/5switchport mode accessaccess vlan 10voice vlan 40Phone traffic is queued ahead of data, and the phone can sit on its own subnet and DHCP scope.
The port behaves like an access port for the PC and like a trunk for the phone. The phone learns the voice VLAN from the switch through CDP or LLDP-MED.

How the phone and the switch agree

  1. The switch port is an access port in the data VLAN (here 10) with a voice VLAN (40) added.
  2. The phone starts up and the switch tells it the voice VLAN ID with CDP (Cisco phones) or LLDP-MED (standards-based phones).
  3. The phone tags its own frames with VLAN 40 using 802.1Q and gets its address from the voice VLAN's DHCP scope.
  4. The PC's frames pass through the phone untouched and untagged. The switch puts untagged frames into the access VLAN, 10.

So the same cable carries one tagged and one untagged VLAN, like a trunk with a native VLAN of 10, but the switch still treats the port as an access port with a voice extension. See tagged and untagged frames for how the tag works.

Why a separate voice VLAN is worth it

  • Quality of service: the switch can trust the phone's markings and queue voice ahead of PC downloads.
  • Security: access lists can keep PCs away from the phone system, and the other way round.
  • Addressing: voice gets its own subnet and DHCP scope, including options such as the call server address.
  • Troubleshooting: a broadcast problem on the data VLAN does not hit calls.

How to configure a voice VLAN

Commands are based on Cisco IOS documentation and have not been run on a lab device here.

vlan 10 name DATA vlan 40 name VOICE ! interface GigabitEthernet1/0/5 description IP phone + PC switchport mode access switchport access vlan 10 switchport voice vlan 40 spanning-tree portfast

Create both VLANs first. The port is an access port in VLAN 10 and also carries VLAN 40 for the phone. PortFast lets the port come up straight away.

The voice VLAN must also be allowed on every trunk between this switch and the call server, and have a gateway and DHCP scope. The switchport voice vlan command has alternatives: dot1p (the phone tags with VLAN 0 and priority only) and untagged (the phone sends untagged frames), for phones that cannot tag a VLAN ID.

Verifying it

Example output · based on Cisco documentation; exact format varies by platform and software version
SW1#show interfaces GigabitEthernet1/0/5 switchport
Name: Gi1/0/5
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Negotiation of Trunking: Off
Access Mode VLAN: 10 (DATA)
Trunking Native Mode VLAN: 1 (default)
Voice VLAN: 40 (VOICE)
Example output. The two lines to check are Access Mode VLAN (the PC's VLAN) and Voice VLAN (the phone's). The port stays in static access mode.

show cdp neighbors should list the phone on that port, and show mac address-table interface gi1/0/5 should show one MAC address in VLAN 40 (the phone) and one in VLAN 10 (the PC).

Voice VLAN faults

Voice VLAN faults and what to check
Voice VLAN faults and what to checkSymptom; Likely cause; Check / fix. Phone gets no address: Voice VLAN not created, or no DHCP scope for it show vlan brief; check the VLAN exists, the DHCP pool and the gateway. Phone works on one switch but not behind another: Voice VLAN not allowed on the uplink trunk show interfaces trunk; add the VLAN to the allowed list. Phone boots into the data VLAN: CDP or LLDP is off on the port, or the voice VLAN is missing Check cdp enable or lldp on the port; check switchport voice vlan. PC loses link when the phone reboots: Expected: the PC is cabled through the phone Nothing to fix; it reconnects when the phone's switch ports come up. Voice is choppy under load: No QoS trust on the port Trust the phone's marking, for example with a QoS policy for voice.SymptomLikely causeCheck / fixPhone gets no addressVoice VLAN not created, or no DHCPscope for itshow vlan brief; check the VLANexists, the DHCP pool and thegateway.Phone works on oneswitch but not behindanotherVoice VLAN not allowed on the uplinktrunkshow interfaces trunk; add the VLANto the allowed list.Phone boots into thedata VLANCDP or LLDP is off on the port, orthe voice VLAN is missingCheck cdp enable or lldp on the port;check switchport voice vlan.PC loses link when thephone rebootsExpected: the PC is cabled throughthe phoneNothing to fix; it reconnects whenthe phone's switch ports come up.Voice is choppy underloadNo QoS trust on the portTrust the phone's marking, forexample with a QoS policy for voice.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: symptom, likely cause, what to check.

Voice VLAN in short

  • An access port plus switchport voice vlan carries two VLANs: data untagged, voice tagged.
  • The switch advertises the voice VLAN ID to the phone with CDP or LLDP-MED.
  • Create the VLAN, allow it on the trunks, and give it a DHCP scope and a gateway.
  • Verify with show interfaces switchport and show cdp neighbors.

Test yourself

Predict · scenario 1

A PC is plugged into an IP phone and the phone into Gi1/0/5 with access VLAN 10 and voice VLAN 40. Which VLAN carries the PC's frames?

Predict · scenario 2

Which protocols tell a phone its voice VLAN?

Predict · scenario 3

A phone gets no IP address. The voice VLAN is configured on the port. What should you check first?

Predict · scenario 4

Is a voice VLAN port a trunk?

Predict · scenario 5

Which benefit is a main reason to put phones in their own VLAN?

FAQ

Is a voice VLAN port an access port or a trunk?
It is configured as an access port, but it carries two VLANs: the access (data) VLAN untagged and the voice VLAN tagged. It is not a trunk, and the port will not appear in show interfaces trunk.
What happens if the voice VLAN does not exist on the switch?
The phone cannot join it and falls back to the data VLAN or gets no address. Create the voice VLAN on the switch and allow it on the uplink trunks.
How does the phone learn the voice VLAN ID?
From the switch, using CDP on Cisco phones or LLDP-MED on standards-based ones. The phone sends its own frames tagged with that ID.