How does a voice VLAN work on an access port with a phone and a PC behind it?
Show the answer
Say this first
The phone learns the voice VLAN from the switch through CDP or LLDP-MED. It tags its own voice frames with that VLAN and CoS 5, and passes the PC's frames through untagged, so they land in the access (data) VLAN. The port is still an access port; it just accepts one extra tagged VLAN. Voice and data get separate subnets, separate policy and separate QoS on one cable.
Go deeper
Configuration
vlan 10
name DATA
vlan 110
name VOICE
!
interface GigabitEthernet1/0/5
switchport mode access
switchport access vlan 10
switchport voice vlan 110
spanning-tree portfast
trust device cisco-phonetrust device cisco-phone (Catalyst 9000 syntax; older switches use mls qos trust device cisco-phone)
trusts markings only while CDP sees a Cisco phone on the port.
Verify
SW1# show interfaces GigabitEthernet1/0/5 switchport | include Access Mode|Voice
Access Mode VLAN: 10 (DATA)
Voice VLAN: 110 (VOICE)show cdp neighbors shows the phone with capability P.
Non-Cisco phones
They read the voice VLAN from the LLDP-MED network policy TLV. Enable lldp run, and on some platforms
define a network-policy profile that names the voice VLAN and apply it to the port.
With 802.1X
Multi-domain authentication (MDA) authenticates the phone into the voice domain and the PC into the data domain on the same port.
They will ask next
Why not just make the phone port a trunk?
A trunk exposes every allowed VLAN to whatever is plugged in behind the phone, runs DTP and changes how spanning tree treats the port. A voice VLAN limits the port to exactly two VLANs and keeps access-port protections.
What happens if CDP is disabled on the port?
A Cisco phone never learns the voice VLAN and sends voice untagged in the data VLAN, unless LLDP-MED or a manual setting on the phone provides it.
Traps
- Calling a voice VLAN port a trunk. It is an access port that also accepts one tagged VLAN.