- In this video I'd like to talk about Voice VLANs.
So, up until now as you're watching this video,
hopefully you've already learned about the concept of just
regular VLANs and you've learned about the concept of
what's called an access port on a switch.
So on a Cisco switch when you type switchport mode access
on an interface, normally that tells the interface
you are in one broadcast domain.
It doesn't know what broadcast domain.
It will assume VLAN1 by default and then you have to
pair that up with the additional command of
switchport access VLAN and then some number,
like switchport access VLAN7, or VLAN6,
which says that any frame that comes in this interface
that's an untagged Ethernet frame will be assigned to that
broadcast domain of VLAN7 or VLAN6,
whatever you've configured.
Then if the other thing you've learned
is this concept of trunks, VLAN trunks,
which can be formed either with switchport mode trunk
or switchport mode dynamic and then dynamic auto
or dynamic desirable, which now means all of the
broadcast domains that you know about, Mister Switch,
VLAN7, VLAN9, VLAN200,
all of them are permissible on this one interface.
The native VLAN will be untagged.
All other Ethernet frames will an 802.1q tag
applied to indicate what VLAN they belong to.
Voice VLAN's is something like right in the middle
so let's talk about what voice VLANS do.
So first of all, what problem is solved by voice VLANs?
Why did they create them?
So here we have your typical situation
where you have an IP phone,
and I'm just going to reference a Cisco IP phone,
connected to your switchport and then you also have,
connected to that phone, some sort of data device,
like a PC or laptop.
And our challenge here is that this switchport right here
is going to be receiving frames that were sourced
by the phone which is carrying your voice traffic.
It's also going to be receiving ingress frames
that were sourced by the laptop, which is your data traffic,
and ideally we want some way for that switch to be able to
tell the difference between frames that were sourced
from the PC as data frames, versus frames
that were sourced from the phone as voice frames.
And the reason we want to be able to differentiate them
is maybe to apply different policy levels to them.
We're talking about quality of service now.
So when the frames come in we want to be able to treat
the voice frames with a higher level of priority,
a higher level of service than we treat the data frames.
So we need to be able to tell the difference between them
and here is where a Voice VLAN comes into play.
So with Voice VLANs it gives us the ability
to basically have two broadcast domains
assigned to this interface on the switch.
We have one broadcast domain which will be for our
access VLAN, which is our data, our untagged Ethernet frames
from the laptop and then we'll have another VLAN
also on this interface which will allow 802.1q tags.
And that will presumably be the traffic
that's carrying our voice inside of the Ethernet frames.
So you can sort of think of this as like
a little mini 802.1q trunk but unlike a normal 802.1q trunk
which could be carrying potentially hundreds of VLANs
with hundreds of different 802.1q tag values,
here we've only got two broadcast domains, not all of the
broadcast domains that this switch might be aware of.
And the way this works here is that inside the IP phone
itself there's actually like a little mini switch.
They say it's like a three port switch so inside the IP
phone you have it's switch, you have one port which is the
data port, and usually if you turn the IP phone around
you'll see on the back of it a little RJ45 that'll say
to PC, right, so this will say here to PC
typically or something like that.
And then you'll see another RJ45 port
which will say something like to switch
and then what you don't realize is
there's another sort of third internal switchport
which goes to the actual CPU,
the Central Processing Unit of the phone itself.
So that's why we say there's like a three port mini switch
inside the phone itself.
And the Voice VLAN feature on the Cisco switch allows us
to program that little mini switch inside the phone.
So it's useful for isolating user data
and voice traffic in the same interface.
OK, so like I said, voice VLANs implies
that there are two VLANs operating on one switchport.
Your access VLAN, which is what your
data traffic will be using, and your voice VLAN
and both must be explicitly configured.
Now the access VLAN, that's configured
the same old way you've always done it.
Switchport mode access, switchport access VLAN, whatever.
So it's no different, and notice,
your mode is still switchport mode access.
The only thing that's different is
we're now going to have a new command
that you haven't seen before to define
what the Voice VLAN is.
Now that helps the switch, the Cisco switch, your 3560,
your 6500, that helps that switch to know,
oh, OK, when I see an ingress frame coming in that's got
an 802.1q tag that says this value may be 90,
I know that's my voice VLAN.
That's a separate VLAN.
I need to do something different with that,
but how do we tell the phone, how do we tell the IP phone,
hey, when you take that voice traffic
and you encapsulate it inside Ethernet frames I want you to
tag that with an 802.1q tag and here's the value.
I want you to put the VLAN90 or VLAN7 in there.
So how do we get that information to the phone?
Well you can see here there's one of two ways.
If it's a Cisco IP phone
we can actually utilize the Cisco Discovery Protocol.
CDP can push down to the phone how it should be reacting
to VLANs and how it should be tagging
or potentially not tagging stuff.
If it's not a Cisco IP phone, well then there is a
specific option, option 156, that you can use in DHCP.
So the DHCP server itself can be preconfigured
to push that information down to the IP phone.
So here's our command: switchport voice vlan,
and you can see you've got four options here.
You can actually type a VLAN ID and this is what
most people do, switchport voice VLAN7, or voice VLAN90.
Most of the time that's what people do
but on this slide I'm going to show you what all these
various options do so you can sort of get an idea as to how
the Ethernet frames are manipulated and what's
actually being instructed to the IP phone
based on these various options here.
So let's start where you say switchport voice vlan and then
you say, like, the number seven, as an example.
So let us put the number seven right here.
OK, so what that would mean,
I'm going to go ahead and expand this a little bit.
That means that when the IP phone sends it's voice traffic
inside of an Ethernet frame
it would put an 802.1q tag
that would say the VLAN is seven
and inside that tag, remember,
there's also what we call priority bits.
Three bits for priority.
And the default behavior of the IP phone
is to set that with the number of five.
So that's what the Ethernet frames
would look like from the IP phone.
And then if there's a laptop connected to this,
when it sends it's frame, well laptops and PCs by default,
they don't do 802.1q tagging,
so there would be no tag on here at all.
There would just be a regular old Ethernet frame.
So, on the switch, when this red frame comes in
without a tag, whatever you've got configured here
of switchport access VLAN, and I'll just put
some number in here, let's say it's VLAN10,
well when this red frame comes in with no tag
it will be assigned to the broadcast domain of VLAN10.
And when the green frame comes in that is explicitly tagged
with the number seven, that will match up with our
switchport voice VLAN command, and the switch will say,
oh, OK, I can allow that.
I know the VLAN7 is the voice VLAN.
So that's how people typically implement voice VLAN,
so there's a couple of other options here as you can see.
The next option is switchport voice vlan dot1p
so what does that mean?
OK, so in that particular case,
when our phone sends it's traffic,
now it has received a CDP message saying,
when you send something I do want you to apply a tag,
an 802.1q tag, but I want the VLAN ID
to actually be the number zero.
And because you're putting that tag in there
you're still allowed to set the priority bits in the tag,
which by default will be the number five.
Now by also saying dot1p we're saying
hey, if you have a PC connected to you,
laptops, PCs, they do have the ability
to send frames with tags and this is called 802.1p.
As a matter of fact,
this priority section of the tag, that is called 802.1p.
So if you go into the NIC card of your laptop or PC
and you say I am enabling you for 802.1p, that means that
laptop will now send a tag also with a VLAN ID of zero.
It'll actually populate the VLAN of all zeros and now from
the laptop you have the ability to set your priority bits.
Now hopefully, whatever that priority is,
will be something that's not five.
It'll be something like maybe three
because at this point the switch right here has no ability
to, at layer two, differentiate between the voice frames
and the data frames because they're both coming in on what
the native VLAN is, so in this particular case, if you've
said switchport access VLAN5 then both of these frames,
because they don't have an explicit VLAN configured,
both of them will go in to the broadcast domain of VLAN5.
Now we don't have really a separate voice or data VLAN.
They're both being lumped together into whatever your access
VLAN is, and the only thing that makes them different
is their layer two priority within their dot1p header,
and also, remember, there's the layer three priority
as well, and in the IP header
there's the IP precedence bits, or the DSCP bits.
So in that particular case the phone will mark it's DSCP,
this is layer three now in the IP header,
that's what's called expedited forwarding,
and we'll get into that some more when we look at QoS,
and the laptop, well, we don't know what it's going to do.
We have no idea what it's going to do, but if the priority
is three then the DSCP will be something that matches that.
Something that matches this right here.
So hopefully, at either layer two or layer three
we'll be able to differentiate the traffic and apply
different Quality of Service policies because at layer two
they're both going to go into the same access VLAN.
So that's what happens when we use the dot1p option
in our switchport voice VLAN command.
We're basically telling the phone,
put a tag with a value of zero in the VLAN.
Now what other options do we have?
Well, what if we do switchport voice VLAN untagged?
OK, so now what's happening, is we're telling the phone,
so via CDP we're saying use VLAN4095.
VLAN4095 is actually a special VLAN number.
It's actually called the dead VLAN.
Kind of a weird thing but it's a reserve VLAN called
the dead VLAN and it's a way of saying don't tag anything.
You are not allowed to use VLAN tags at all.
So my Cisco switch now is telling the phone
you can't do 802.1q.
No tags allowed from you at all.
So what does that actually look like?
Well, in this particular case now, we would see the IP phone
just sending a regular Ethernet frame with,
like I said, no tag. No tag.
But remember, at layer three in the IP header
it's going to have all this used IP precedence
because IP precedence is easier to understand than DSCP
and in layer three we're going to have an IP precedence
which is in the ToS byte of the IP header
which is going to be equal to five.
That's the default value that phones give at layer three.
And if I have a laptop or PC here, well once again
the assumption is by default laptops and PCs don't do tags
and they don't do IP precedence, so there will be no tag
unless someone's really messed around with their NIC card
this will be the default behavior of the laptop or the PC.
There will be no tag and at layer three
the default behavior of IP precedence in every single frame
that you send, whether it be web browsing
or telnet or email, is always zero.
So once again, whatever the access VLAN is here,
switchport mode access, sorry for my sloppy writing here,
access, equals, let's say 90, well then both of these frames
will be assigned to the broadcast domain of VLAN-90
and the only way we'll be able to differentiate them,
the only way we'll be able to apply different policies
will be based on what we see in the layer three header,
the IP header, that will be it.
And then of course your last option is
switchport voice VLAN none, and that means, once again,
there is no, I'm not giving you any VLAN or whatsoever,
so now the IP phone doesn't really know what to use
for a 802.1q tag, so it'll probably
try to get that information via DHCP.
But if DHCP doesn't give it a tag, well then at this point
it'll be exactly the same as the previous scenario,
as scenario three.
If this phone is not being given a voice VLAN from my switch
and if it's not being given a voice VLAN via DHCP
then scenario four and scenario three
will end up being exactly the same thing.
So how do we verify if there's a voice VLAN,
and if there is, what it is?
Well we can do the command
show interface switchport to see that.
For example, if I go on the switch right now,
if I do show interface fast Ethernet 0/1 switchport,
make this a little bit larger here for you guys,
so right now there is no voice VLAN.
Right here, I have not configured any.
And the default access VLAN is VLAN1.
All I have to do is go into my interface
and say switchport voice VLAN and I'll use VLAN2 now.
In my case VLAN2 has not actually been created yet
so this particular switch, like many other Cisco switches,
will create the VLAN since it doesn't already exist,
and now when I do that same show command
it'll explicitly say that may voice VLAN is two
and you can see how that's different
than my access mode VLAN which is one.