Cisco Voice VLAN Setup for IP Phones (Auxiliary VLAN)

The Cisco voice VLAN feature lets a single access port carry two logical networks to an IP phone: a data VLAN for the PC plugged into the phone, and a voice VLAN for the phone itself. The phone is told which VLAN to use through CDP, and the switch can trust or override the 802.1p priority the phone stamps on its voice frames so call quality survives congestion. This guide covers the configuration modes of switchport voice vlan and a complete phone-port example on Catalyst IOS XE switches.

How Voice VLAN Works

When a Catalyst switch port connects to a Cisco IP Phone, the phone sends voice traffic with Layer 3 IP precedence and Layer 2 CoS values set to 5 by default. The switch can instruct the phone, via CDP, to send voice traffic in one of these ways: tagged in a dedicated voice VLAN with a CoS value; tagged with CoS in the access (data) VLAN; or untagged. Voice VLANs are supported only on access ports, and the voice VLAN must exist and be active on the switch before the phone can use it.

Configuration Example

Create the voice VLAN, then configure the phone port with a data VLAN for the PC, the voice VLAN for the phone, and trust for the phone device:

Switch# configure terminal
Switch(config)# vlan 200
Switch(config-vlan)# name VOICE
Switch(config-vlan)# exit
Switch(config)# interface gigabitethernet1/0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport voice vlan 200
Switch(config-if)# trust device cisco-phone
Switch(config-if)# spanning-tree portfast
Switch(config-if)# end

Now the PC behind the phone is in VLAN 10 and the phone registers in VLAN 200; QoS trusts the CoS coming from the phone so voice packets keep their priority end to end. If you use auto-QoS, the trust command is applied automatically by auto qos voip cisco-phone.

Voice VLAN Modes

• switchport voice vlan 200 — phone sends voice tagged in VLAN 200 with 802.1p CoS 5 (default, recommended).
• switchport voice vlan dot1p — phone uses 802.1p priority tagging in the native/access VLAN (VLAN 0); useful when no separate voice VLAN exists.
• switchport voice vlan untagged — phone sends voice untagged in the access VLAN.
• switchport voice vlan none — phone uses its own configuration for untagged voice traffic.

dot1p is not supported on Catalyst 9500X/9600X; CDP must be enabled on the port (default) because CDP is how the switch tells the phone which mode to use.

Verification

show interfaces gigabitethernet1/0/1 switchport
show running-config interface gigabitethernet1/0/1
show vlan id 200
show cdp neighbors gigabitethernet1/0/1

The switchport output shows the operational voice VLAN and the administrative voice VLAN; if the phone never registers, confirm the voice VLAN is active in show vlan, CDP is running toward the phone, and the phone's data/voice trust settings match the switch. Voice VLAN fundamentals pair with the general trunk and SVI design in our Cisco VLAN and inter-VLAN routing guide, and with port security on the same access ports in Catalyst port security with sticky MAC.

Why a Separate Voice VLAN Exists

Putting a phone and a desktop PC on the same Layer 2 segment works, right up to the moment the PC saturates the link. Voice is small, constant and latency-sensitive; data is bursty and indifferent to jitter. Separating them into two VLANs on one physical port gives you three things at once: an independent broadcast domain for voice, a clean place to apply QoS policy that only affects call traffic, and the ability to route and firewall voice differently from data without running a second cable.

This is why Cisco calls it the auxiliary VLAN. The access port keeps its data VLAN for the attached PC, and a second logical VLAN carries the phone's own traffic, tagged with 802.1Q, over the same wire. The phone is the device that decides which frames belong to which VLAN, and the switch tells the phone what to do through CDP or LLDP-MED.

Requirements and Prerequisites

Voice VLAN has a small number of hard requirements, and almost every "the phone will not register" case is one of them:

• The port must be an access port. Voice VLAN configuration applies to access ports; on a trunk port the phone VLAN is simply one of the allowed tagged VLANs and the whole auxiliary-VLAN mechanism is not used.
• The voice VLAN must exist and be active. A VLAN that is created but not active — for example one that is suspended by VTP or has no active member ports — cannot be used by the phone. Confirm with show vlan id 200.
• CDP must be running toward the phone. CDP is the signalling channel for the default mode. If CDP is disabled on the port, the phone never learns the voice VLAN and falls back to its own configuration, which usually means untagged traffic in the data VLAN.
• IP addressing must be reachable. The phone needs a DHCP scope, or a TFTP/CUPS server address for manual provisioning. Cisco phones traditionally get the boot server address from DHCP option 150.
• QoS trust must be configured somewhere. Without a trust boundary the phone's CoS 5 marking is either stripped or ignored, and voice competes with bulk data.

Complete Configuration: Phone Port, Uplink and DHCP

A working deployment needs three pieces: the VLAN and its Layer 3 gateway, the phone port, and the uplink that carries voice traffic to the rest of the network. The example below assumes VLAN 10 for data and VLAN 200 for voice.

! Layer 2 definition and Layer 3 gateway
vlan 10
 name DATA
vlan 200
 name VOICE
!
interface vlan 200
 description Voice gateway
 ip address 10.200.0.1 255.255.255.0
!
interface vlan 10
 description Data gateway
 ip address 10.10.0.1 255.255.255.0
!
! DHCP scope for phones, handing out option 150
ip dhcp pool VOICE
 network 10.200.0.0 255.255.255.0
 default-router 10.200.0.1
 option 150 ip 10.200.0.10
!

With the addressing in place, the phone port itself is configured with the data VLAN, the voice VLAN, a QoS trust statement for the phone, and PortFast so the phone does not wait through spanning-tree convergence before it starts registering:

interface GigabitEthernet1/0/1
 description IP phone + PC
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 200
 switchport priority extend cos 0
 trust device cisco-phone
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
!

The uplink between switches is a trunk that must carry both VLANs, with the voice VLAN allowed explicitly. A trunk that permits only the data VLAN is a frequent cause of phones that boot, get an address, and then fail to reach the call manager:

interface GigabitEthernet1/0/24
 description Uplink to distribution
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,200
 spanning-tree guard loop
!

The result: the PC behind the phone is in VLAN 10, the phone registers in VLAN 200, and the CoS value the phone stamps on its voice frames is trusted by the port so priority survives congestion. On platforms that support it, the auto qos voip cisco-phone command applies a pre-built trust and queueing policy in one step and is a reasonable starting point before hand-tuning a custom policy.

QoS Trust Boundary and CoS Handling

Voice VLAN gives you separation; QoS gives you the guarantee. Cisco phones mark voice frames with Layer 2 CoS 5 and Layer 3 IP precedence 5 by default, but a marking is only useful if some device trusts it. The trust device cisco-phone command moves the trust boundary out to the phone port, which is safe because the phone is a known device that will not spoof the marking. Between the phone and its PC port, the phone re-marks PC traffic as best effort, so the trust statement does not hand the PC a way to grab priority.

The switchport priority extend cos 0 statement is the switch telling the phone how to treat frames arriving from the PC: it forces CoS 0 on data traffic coming from the downstream port. Without it, a PC that marks its own frames CoS 5 would have those markings trusted at the switch, which is exactly the abuse case the trust boundary was supposed to prevent. On a strict deployment you should confirm the marking policy end to end; the general model is the same for all access ports and is covered in QoS trust boundary and DSCP marking on Cisco switches.

Two caveats are worth remembering. First, trusting CoS at the access layer is only meaningful if the uplinks preserve it — a trunk that re-marks or a WAN link that drops Layer 2 priority breaks the chain. Second, on wired-only deployments, a trust statement without queueing policy still leaves voice in the same queue as data; the classification work is the enabler, not the guarantee.

LLDP-MED as an Alternative to CDP

Cisco phones speak both CDP and LLDP-MED, and voice VLAN can be signalled with either. LLDP-MED has the advantage of being an open standard, which matters on mixed-vendor access layers where the phones and the access switches come from different vendors. The switch advertises a network policy TLV containing the VLAN ID, the Layer 2 priority and the DSCP value, and the phone applies it.

! Global LLDP and MED configuration
lldp run
!
interface GigabitEthernet1/0/1
 lldp transmit
 lldp receive
 lldp med-tlv-select network-policy
!

When both protocols are enabled, behaviour depends on the platform and phone firmware; Cisco phones generally prefer CDP. If the phone registers in the wrong VLAN, disabling one of the two is the fastest way to determine which one the phone is actually following. Note also that the CDP data and voice VLAN signalling carries the voice VLAN in the network-policy advertisement, so switchport voice vlan none with LLDP-MED policy is a legitimate design where the VLAN is communicated by MED rather than by CDP. Voice VLAN can be used on the same access ports as 802.1X deployments, but the authentication ordering matters; see 802.1X and MAB configuration.

Voice VLAN on Trunk and Uplink Ports

Aswitch-to-switch link never uses the auxiliary-VLAN feature, because both ends are switches rather than phones. The voice VLAN is simply one of the tagged VLANs in the trunk's allowed list, and the phone's traffic crosses it as ordinary tagged traffic. Two things commonly go wrong here:

• The voice VLAN is missing from the allowed list. Phones get a DHCP address from a local scope and then fail to register, because signalling to the call manager never crosses the trunk.
• The voice VLAN is not in VTP or not carried by VTP in the right mode. A transparent-mode switch does not learn the VLAN, so the trunk carries a VLAN the downstream switch does not know.

Also check the spanning-tree topology when voice VLAN is used on a large access layer: a PortFast access port with BPDU guard is safe, but a trunk with a missing voice VLAN can leave the voice Layer 3 gateway unreachable even though the phones themselves are up.

Troubleshooting: Phone Does Not Register

Work the problem in the order the phone works it — power, data VLAN, voice VLAN, addressing, TFTP, then signalling:

show interfaces GigabitEthernet1/0/1 switchport
show vlan id 200
show cdp neighbors GigabitEthernet1/0/1 detail
show ip dhcp binding | include 10.200
show power inline GigabitEthernet1/0/1
show mac address-table interface GigabitEthernet1/0/1

• No CDP neighbour. CDP disabled on the port, cable or power problem, or the phone has not finished booting. Check show power inline first on PoE deployments.
• Operational voice VLAN is empty. The administrative voice VLAN is set but the phone never negotiated one — usually a CDP or phone-configuration issue rather than a switch issue.
• Phone has no IP address. DHCP scope for the voice VLAN is missing, exhausted, or the helper address is not reachable from the phone's gateway.
• Phone has an address but no registration. Option 150 pointing at the wrong TFTP server, or the voice VLAN not carried across the trunk.
• Audio is choppy under load. Trust or queueing policy missing on the path. Check the trust boundary configuration on both the access port and the uplink.

PoE deserves a separate check on access switches: an 802.3af budget that is fully committed to phones will refuse to power additional devices without a clear error, and power-related reboots masquerade as registration failures. The budget arithmetic and class differences are covered in PoE standards explained.

Verification Checklist

Before declaring a voice VLAN deployment complete, confirm the following on at least one representative port and one trunk:

• The voice VLAN exists, is active, and is present on every switch in the voice path.
• The access port shows the intended data VLAN and the operational voice VLAN.
• The trust boundary is set on the phone port and the uplink preserves CoS.
• The phone learns its VLAN (via CDP or LLDP-MED), obtains an address from the voice scope, and registers with the call agent.
• A capacity check: 802.3af/at power budget is not oversubscribed.

Voice VLAN fundamentals sit on top of ordinary VLAN design, so the Layer 2 and Layer 3 building blocks are worth revisiting alongside this article: see the Cisco VLAN and inter-VLAN routing guide and, for the same access ports, Catalyst port security with sticky MAC.

FAQ

• Can one port carry both a phone and a PC? Yes — that is the point of the auxiliary VLAN design. The phone presents two logical connections: its own, and the pass-through port for the PC.
• Is a separate voice VLAN mandatory? No. switchport voice vlan dot1p or untagged let the phone stay in the data VLAN while still getting priority marking, but you lose the separate broadcast domain and the clean policy boundary.
• Do I need QoS to use voice VLAN? Strictly no, practically yes. Without a trust boundary and queueing the VLAN separation alone does not protect call quality.
• Why is dot1p refused on my switch? It is not supported on some newer fixed platforms such as the Catalyst 9500X/9600X. Use a tagged voice VLAN or untagged mode instead.
• Does this apply to third-party phones? The switchport configuration does, but the signalling does not. Non-Cisco phones use LLDP-MED or manual provisioning, and will not respond to CDP-only configuration.

原文链接：https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-9/configuration_guide/vlan/b_179_vlan_9300_cg/configuring_voice_vlans.html