Overview
IP phones need isolated voice VLANs, QoS trust, and DHCP Option 150 for TFTP configuration. This guide covers switchport voice VLAN, CUCME basics, and how voice ties into the QoS pipeline.
Why voice gets its own VLAN
IP phones and PCs can share one cable, but they should not share one broadcast domain for call traffic. A dedicated voice VLAN provides:
| Goal | Mechanism |
|---|---|
| Security | PC on data VLAN cannot easily capture phone RTP streams on a separate voice subnet |
| QoS | Voice frames marked and queued with higher priority than best-effort data |
| Operations | DHCP, TFTP, and CUCM registration scoped to voice infrastructure |
jdepew88 notes emphasize that separating host and phone subnets prevents the PC from "listening in" on call packets. Panagiss adds the switch configuration: switchport access vlan for data + switchport voice vlan for voice.
Physical connection models
- Phone → switch (PC unplugged) — phone alone on access port
- Phone → switch, PC → phone (pass-through) — most common desk layout
- Phone powered by wall adapter, PoE injector, or 802.3af/at PoE from the switch
The switch port is still one access port with two logical VLAN memberships: data (untagged from PC) and voice (tagged/CDP-negotiated for phone).
Voice VLAN switch configuration
interface FastEthernet0/10 description IP Phone + PC switchport mode access switchport access vlan 10 switchport voice vlan 20 mls qos trust cos
- VLAN 10 — data subnet for the PC (
switchport access vlan) - VLAN 20 — voice subnet for the phone (
switchport voice vlan) - Phone discovers voice VLAN via CDP (Cisco) or LLDP-MED (multi-vendor)
Enable QoS trust on phone ports so CoS/DSCP markings from the phone are honored — voice stays prioritized through the campus.
Cisco IP phone boot process
Understanding phone startup helps you troubleshoot "phone gets IP but won't register" scenarios:
- Power on — wall power, injector, or PoE/POE+ from switch PSE
- Load stored image and last-known config from flash
- Learn VLAN — switch advertises voice VLAN via CDP/LLDP-MED
- DHCP — phone requests address on voice VLAN; Option 150 points to TFTP server
- Download config/firmware from TFTP
- Register with call manager — CUCM (enterprise) or CUCME (router-embedded) via SCCP or SIP
- Softkey template download (SCCP environments)
Missing DHCP Option 150 (TFTP server IP) is a common lab exam trap — phone has an IP but cannot download config or register.
Power over Ethernet (PoE)
Phones are powered devices (PD); switches are power sourcing equipment (PSE).
| Standard | Power | Notes |
|---|---|---|
| Cisco pre-standard | ~6.3 W | Proprietary early implementation |
| 802.3af (PoE) | 15.4 W (Class 3) | Multi-vendor interoperability |
| 802.3at (PoE+) | 30 W | High-end phones, APs, cameras |
802.3af PoE classes — switch negotiates power budget with the powered device.
From study charts · jdepew88 CCNA notes
Discovery: PSE sends low voltage and expects 25 kΩ signature resistance. Cisco historically used Fast Link Pulse (FLP) to detect PoE-capable phones vs PCs.
Mid-span power injectors add PoE when the switch lacks PoE — useful in retrofit deployments.
CUCME vs CUCM (CCNA scope)
| Platform | Role |
|---|---|
| CUCM (Call Manager) | Enterprise centralized call control; phones register to cluster |
| CUCME (Express) | IOS-based call control on a router — common in CCNA labs |
Phones need reachability to the TFTP server and the call agent IP. Routing between voice VLAN and server subnets must work; inter-VLAN routing and ACLs must permit SCCP/SIP and RTP media ports.
QoS for voice
Voice is delay-sensitive and loss-intolerant. Campus QoS pipeline:
- Classify — identify voice/signaling traffic
- Mark — set CoS (Layer 2) or DSCP (Layer 3) — voice often EF (DSCP 46) / CoS 5
- Queue — prioritize voice in hardware queues
- Police/shape — protect voice from data bursts
QoS recommendations — voice traffic gets strict priority queuing.
From study charts · jdepew88 CCNA notes
On the access port:
- Phone marks voice frames with higher CoS
mls qos trust cos(ortrust dscp) tells the switch to accept those markings- Queuing policies on uplinks preserve priority end-to-end
Full QoS policy design spans access, distribution, and WAN — see the QoS topic for marking and queuing depth. Voice VLAN is the access-layer hook that starts the pipeline.
Port security with phone + PC
A single access port with phone and PC typically needs two MAC addresses:
interface FastEthernet0/10 switchport mode access switchport access vlan 10 switchport voice vlan 20 switchport port-security maximum 2 switchport port-security mac-address sticky
Without maximum 2, port security shuts down when the second MAC (PC) appears.
DHCP and voice VLAN
Voice VLAN is a separate broadcast domain — it needs its own DHCP scope on the voice subnet:
- Voice gateway (router/SVI) on voice VLAN
- DHCP scope for phones with Option 150 = TFTP server IP
- DNS/NTP as required by CUCM/CUCME design
Cross-reference Switch Security if DHCP snooping protects the voice VLAN from rogue servers.
Verification commands
show interfaces FastEthernet0/10 switchport show vlan brief show power inline show cdp neighbors detail show mls qos interface FastEthernet0/10
Design workflow
- Create data and voice VLANs with separate subnets
- Configure access ports:
switchport access vlan+switchport voice vlan - Allow both VLANs on trunks to distribution/core
- Enable QoS trust on phone ports; mark/queue on uplinks
- DHCP scope on voice VLAN with Option 150
- Set port security maximum 2 where PC passes through phone
- Test: phone registers, dial tone, PC still reaches data network
Exam checklist
| Trap | Detail |
|---|---|
Forgot switchport voice vlan | Phone stays on data VLAN — wrong subnet/QoS |
| No DHCP Option 150 | Phone gets IP but no TFTP/config |
| Port security max 1 | Phone+PC triggers violation shutdown |
| QoS trust disabled | Phone CoS markings ignored — voice competes with data |
| Voice VLAN not in trunk allowed list | Phone works locally but not across switches |
| Confusing access vs voice VLAN | Access VLAN = data; voice VLAN = overlay for phone traffic |