I have to configure an IP EPABX e.g., an NEC 9100 series. I have an HP managed PoE switch. We have existing VLANs 5 and 50. VLAN 5 is for wireless/guests, and VLAN 50 is for the Internet.

  • VLAN 5: Ports 1,2,3,4
  • VLAN 50:Ports 35,36,37,38
  • Ports 45,46,47,48 are for uplinks to other switches

I have to configure VLAN 10 for VoIP on the existing switch. My office wants me to configure the EPABX with the static IP Then the VoIP phones will receive the IP addresses from PCs need to be connected to the VoIP phones, and the PCs should get IP addresses from

This is my first task with any EPABX. Is it possible? Is the EPABX able to route?

enter image description here


2 Answers 2


NOTE: Adjusted from an answer I accidentally posted on an old question

Your layer 3 (IP) is kinda irrelevant! Your PCs can be (and should be) on a different subnet completely decoupled from your voice vlan. Now, to the point. As I wrote in the previous post and with the help of this post:

  • Keep your up-links tagged (I tend to use ports at the end - i see you do too ... ++)
  • Voice is also tagged based on the above link
  • Data will always be untagged on access ports (servers might be an exception - this is mainly for desktops)

So, to the config (# and after are comments):

vlan 5
   name "guests"
   untagged 1-4 # wifi ports
   tagged 45-48 # uplinks

vlan 10
   name "voice"
   tagged 35-38,45-48  # Includes uplinks - based on the prev post voice is tagged
   untagged 12 # This is the EPABX... i just assumed 12... adjust
   qos priority 6 # based on the previous post, L2 priority I assume

vlan 50
   name "data" 
   untagged 35-38 
   tagged 45-48 # uplinks

What's going on?:

  • your data remain the same (vlan 50) and wifi guests (vlan 5)
  • voice vlan sends tagged to the phones (35-38) and also (if needed) to your uplinks. Phones should pick-up tagged traffic but forward untagged packets to the data - which belongs to vlan 50
  • you send your voice traffic untagged to the EPABX via port 12 (I might be wrong here, you might have to tag it)
  • Nothing changes on the guest wifi

Now depending on what the EPABX is (I have not configured one of those...) it might require tagged traffic on both data and voice so it can route between them... not sure


Based on the question how the PCs are getting IPs: You can think of VLANs as separate LANs, each one using a different switch so your phones are completely separate from the PCs. Then notice that on ports 35-38 we send both vlan 10 and 50 with the difference that 50 has a dot1q tag on the frame. Each phone has a simple bridge/switch. It keeps the tagged traffic for itself and is forwarding all the untagged to the PC port. So, for example, when the PC is doing a DHCP request:

  1. DHCP req. is broadcast
  2. The phone will receive an untagged frame from the PC port which will forward to the switch (as is, no tag added)
  3. The switch sees the frame on port 36 without a tag so it knows it belongs to vlan 50 (if the phone was doing the DHCP the frame would have a tag and the switch will see it as vlan 10)
  4. The switch will forward the frame on all ports that belong to vlan 50, including uplinks. On the uplinks the switch is adding a tag to the frame before sending it.
  5. The DHCP server for PCs is on the same vlan (50), sees the request and sends a reply
  6. The reply is received from the switch which now knows the PCs mac address is untagged on port 36 so it forwards the frame to that port
  7. The phone receives the DHCP reply frame, but since it is untagged it does not look into it, it directly forwards it to the PC
  8. PC now has an IP! (few ACKs go up and down the same way)

Now, if the phone was doing the DHCP:

  • Step 3: Switch would see vlan 10
  • Step 4-5: The same but for vlan 10 which means that different DHCP server receives the request
  • Step 6: The switch now knows the phone's MAC is behind port 36... but this time it is tagged
  • Step 7: The phone receives a tagged frame so it keeps it/looks into it and does not forward
  • Step 8: Phone now got an IP, note that the PC saw no traffic at all. Completely separate network

Finally, note that since we are talking for a switch, we are staying on OSI Layer 2. Everything involving vlans is in this layer. We have not yet setup any routing. If for any reason your phones should be able to talk to the PCs, then a layer 3 router is required to connect the two networks (currently completely independent from each other)

Hope it helps

  • well...thanks Urban for your help. I did configure the EPBAX and the ip phone exactly the way you suggested. But i am little confused as to how the PC is getting the IP of I mean there is no route or no intervlan routing, then how can a pc connected to the IP phone get the IP of I believe the PC should have got the IP of 192.168.1.x. Can you please clear the air little bit?
    – de.walkar
    Mar 9, 2016 at 7:20
  • Great explanation Urban. Thank you. I got exactly what i was looking for. Like you said, i need the PC to communicate with the IP phone and the EPABX. I mean, i need to configure the IP phone and EPABX for various reasons. Firstly i could not ping the IP of IP phone and EPABX from my pc. Then a friend of mine suggested to me to keep the static ip on the Pc and have additional IP there in the advanced option that of IP phone.
    – de.walkar
    Mar 9, 2016 at 15:50
  • Great explanation Urban. Thank you. I got exactly what i was looking for. Like you said, i need the PC to communicate with the IP phone and the EPABX. I mean, i need to configure the IP phone and EPABX for various reasons.Firstly i was not able to ping the IP of IP phone and EPABX from my pc. Then a friend of mine suggested to me to keep the static ip on the Pc and have additional IP there in the advanced option that of IP phone. Now i can ping the IP phone and the EPBAX but still can't access them via gui. what could be the reason??
    – de.walkar
    Mar 9, 2016 at 15:58
  • While i connect my laptop directly to the switch, have the static ip of EPABX as the gateway and IP of the same range in my laptop, i can access the GUI interface of it. Now as i was checking on to the changes, i came to know that without creating a voice vlan too i can get my IP phone and EPABX to work fine. I mean, when i plug my IP phone to default vlan ie, 1, which is untagged, yet the IP phone worked fine and Pc was getting the right IP. If so, why bother creating another vlan and why bother much about tag and untag?? please clearify. Thanks in advance.
    – de.walkar
    Mar 9, 2016 at 16:00
  • Not quite sure how your management is configured! Also not sure if/how phones handle untagged traffic (static IP may allow it). You usually don't mix traffic. Voice is higher priority and that is configured on the vlan (qos priority 6). Also, it is good to keep your management separate from data mainly for security, same way you don't put guests in your data lan. Of course you can wipe the switch and everything should work... but you are merging broadcast domains ( and 10.x.y.z will receive each others BCs). This gets really ugly really fast on large setups...
    – urban
    Mar 9, 2016 at 17:00

Basically, you need to define the VLANs correctly. Set up a VoIP VLAN, in your case 50, as a tagged VLAN for your ports where the phones will be connected, but untagged for your PBX. The data VLANs will be untagged on the ports where they are today.

A simple Internet will give you a lot of hits with example, such as this one from MichaelvLonden, Advisor :


vlan 11                                              (this creates vlan 11)

vlan 12 voice                                    (this creates vlan 12 and labels it as voice vlan)

vlan 11 untagged 1                         (interface 1 is added to the access vlan 11)

vlan 12 tagged 1                            (interface 1 is added to the voice vlan 12)


wr m

Just adjust the VLAN and interface numbers (data and VoIP) for your particular usage.

  • Thanks Ron. Can i ask why the PBX needs to untagged and the ip phone needs to be tagged?
    – de.walkar
    Mar 9, 2016 at 7:26
  • The PBX is an end-device, like a PC or server, so it is going to be looking for untagged frames. The phones are really switches, and they need tagged frames for themselves, and they will send the untagged frames to the end-devices which are connected to them.
    – Ron Maupin
    Mar 9, 2016 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.