I’ll admit it. The voice VLAN confuses the hell out of me. In our production network we assign an access VLAN and a separate voice VLAN to each user switchport:
switchport access vlan 100
switchport voice vlan 200
My understanding is that this is a trunk. We’re trunking VLANs 100 and 200 to the IP phone. But if you do a ‘show interfaces trunk’ command, the ports configured for a voice and data VLAN do not show up as trunks. And if we look at the switchport setting for the port, we can also verify that it is not trunking(output is from a 3640 with a NM-16ESW module emulated via Dynamips):
sw1(config-if)#do sh int f0/1 switchport
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Disabled
Access Mode VLAN: 100 (VLAN0100)
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: ALL
Trunking VLANs Active: 100
Priority for untagged frames: 0
Override vlan tag priority: FALSE
Voice VLAN: 200
Appliance trust: none
The 3560 configuration guide even goes so far as to warn you:
Note Voice VLAN is only supported on access ports and not on trunk ports, even though the configuration is allowed.
Also, I’ve been told “No silly little man, those aren’t trunk links.” Okay. Then how the hell are we passing two separate VLANs between the IP phone and the switchport?
This dilemma was recently raised on GroupStudy:
If we said switchport voice vlan under the interface, it’s mean the port become a trunk ?
When we have switchport access vlan also, which one is tag with vlan header after exiting the port ? Voice vlan or data vlan ?
Cisco calls this a Multi-Vlan access port, and NOT a trunk port. if it were a trunk port, according to Cisco, it would flood all vlans configured on the switch out to the phone. As you probably know already, a port configured for voice Vlan does not flood out all Vlans to the phone, just the voice vlan frames (tagged) and the data frames ( untagged ).
Multiservice switches supports a new parameter for IP Telephony support that makes the access port a multi-VLAN access port. The new parameter is called an auxiliary VLAN. Every Ethernet 10/100/1000 port in the switch is associated with two VLANs
– A Native VLAN for data service that is identified by the port VLAN identifier or PVID
– An Auxiliary VLAN for voice service that is identified by the voice VLAN identified or VVID.
– During the initial CDP exchange with the access switch, the IP phone is configured with a VVID.
– The IP phone also supplied with a QoS configuration using Cisco Discovery Protocol. Voice traffic is separated from data, and supports a different trust boundary.
Data packets between the multiservice access switch and the PC or workstation will be on the native VLAN. All packets going out on the native VLAN of a 802.1q port are sent untagged by the access switch. The PC or workstation connected to the IP phone usually sends untagged packets.
Voice packets will be tagged by the IP phone based on the Cisco Discovery Protocol information from the access switch.
*The multi-VLAN access ports are not trunk ports, even though the hardware is set to dot1q trunk*. The hardware setting is used to carry more than two VLANs, but the port is still considered an access port that is able to carry one native VLAN and the Auxiliary VLAN. The ‘switchport host’ command can be applied to a multi-VLAN access port on the access switch.
If I understand this correctly, although the switchport is configured to use two different VLANs, only the voice VLAN traffic is actually tagged by the IP Phone. The data VLAN is sent untagged (making use of the native VLAN dot1q feature). This STILL sounds like trunking to me though. 🙂 This gives me high school Physics flashbacks about photons (“Is it a wave or a particle?” “It’s both…and neither.” <head explodes>). Scott Morris agrees:
That’s a fancy name for a small trunk. I agree. If you have tagged frames, it’s a trunk.
If it has two wheels and pedals, it’s a bicycle. They have some weird looking ones these days, but they’re still bicycles. Call it a multi-unicycled transportation device if you want, but it’s still a bicycle.
Would you see anything different if you turned off CDP, set the port as a trunk port, used the trunk allowed vlan command to only allow the access/voice vlans, set the native vlan to equal the data vlan and went down that path?
Scott Morris, CCIE4 #4713, JNCIE-M #153, JNCIS-ER, CISSP, et al.
Senior CCIE Instructor
So I guess that I’ll just have to accept the whole trunk/non-trunk duality when it comes to the voice VLAN.