Switching · VLANs and Trunking

Voice VLAN

Separate phone and workstation traffic on a shared desk connection.

Independent lab examples; selected output and frame summaries are illustrative. Port naming and command support vary by switch and software release.

Network and objective

Voice VLAN behavior requires a compatible phone and switch; CDP or LLDP-MED provisioning and QoS trust are platform-dependent.

An IP phone connects to SW1 Gi1/0/1; H1 connects through the phone’s local switch. Use data VLAN 10 and voice VLAN 20.

Physical links are solid; device roles and relevant links are labeled.

How it works

The phone can forward the workstation’s ordinary untagged frames into data VLAN 10 while sending its own voice traffic tagged for VLAN 20. One physical cable carries two logical domains. The phone must learn or be configured for the intended voice VLAN; merely creating VLAN 20 does not assign an IP address or provide call control.

Provision DHCP, gateway reachability and voice services in the relevant VLAN separately. PoE supplies power, not VLAN membership. QoS trust must reflect endpoint policy; a voice tag is not proof that a device is authorized.

Configure or inspect

vlan 10
vlan 20
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20
 spanning-tree portfast
 no shutdown

Verify the result

Illustrative output · selected lines

SW1#show interfaces GigabitEthernet1/0/1 switchport
Administrative Mode: static access
Operational Mode: static access
Access Mode VLAN: 10 (VLAN0010)
Voice VLAN: 20 (VLAN0020)

The port can remain reported as access while supporting an auxiliary voice VLAN. Verify the phone’s learned VLAN and DHCP result, then the workstation’s data address.

Failure and recovery

If the workstation works but the phone has no address, inspect voice VLAN provisioning, allowed uplinks and its DHCP scope. Changing the data VLAN can break the working device without repairing the voice path.

Restore the intended phone provisioning and VLAN 20 end-to-end reachability. Confirm separate data and voice leases before testing calling.

Key Takeaways

A desk port can carry untagged data and tagged voice.
Phone provisioning is a separate dependency.
PoE and VLAN assignment solve different problems.
Verify both domains end to end.
A voice tag is not endpoint authentication.