1

Today my company had an annoying issue with DHCP looping. I spent more than 2 hours to figure out why several PCs get IPs from VOIP subnet. My manager spent about 30 minutes and figured out that someone plugged DATA port and VOIP port back of the phone. How do I prevent that so we don't have that kind of issue again? Does DHCP snooping prevent that type issue? if not, please let me know how to prevent that happen?

Improve this question
10
  • 2
    In a Cisco environment you can use switchport voice vlan option to separate data and voice. When you connect a Cisco IP phone the phone will get the voice vlan and the PC connected to the phone will get the data vlan.
    – user36472
    Nov 2, 2017 at 17:58
  • I'm not sure I understand what happened. Are you saying a user plugged their PC into the Voice switch port? What kind of phones are you using?
    – Ron Trunk
    Nov 2, 2017 at 18:15
  • No, user plugged data wall port to the phone's data jack and the phone goes to VOIP jack. I hope it makes sense to you.
    – Will
    Nov 2, 2017 at 18:22
  • @RonTrunk My guess is the voice and data VLANs are both untagged on the ports in question and the phone combined the two broadcast domains.
    – Todd Wilcox
    Nov 2, 2017 at 18:36
  • Thanks Todd. That is correct. At our environment all ports are untagged. We are going to buy new switches, I will add tag for Voice but will it solve this issue?
    – Will
    Nov 2, 2017 at 18:43

2 Answers 2

Reset to default
3

Without knowing a lot more about your infrastructure...

  1. Disable the "data" port on all your phones. You appear to have dedicated voice and data ports to everyone, so there's no need for daisy chaining through the phone.

  2. Enable what Cisco calls bpdu guard. If any spanning-tree BPDU is seen on an "edge" port, the port is immediately disabled.

  3. Running CDP / LLDP will help chase down what ports have been looped. If you see a switch neighbor on a port that shouldn't be connected to a switch...

Improve this answer
4
  • Our phone doesn't have feature to disable data port. Our current swiches are 10 years old Netgear since our network is untagged so I guess previous IT did not buy switches that came with BDPU features. We are going to replace them with new HP switches.
    – Will
    Nov 2, 2017 at 20:38
  • 1
    So, you have a perfect storm of the worst possible combination of technologies. (1) can't turn off the data port, (2) have no loop detection/prevention mechanisms, and (3) have almost no way to see what's plugged into to what. Thus... 1a super-glue the data port shut! (there are ethernet lock-out plugs -- I make my own by dry-crimping an RJ45 and then cutting the release arm off)
    – Ricky
    Nov 3, 2017 at 1:28
  • HP switches, by default, do not enable spanning tree. Turn it on.
    – Ron Trunk
    Nov 3, 2017 at 18:25
  • Thanks Ricky, I like your comment. I'll super glue next time :)
    – Will
    Nov 7, 2017 at 14:22
2

Since you are considering changing switches, you can use mac-based-vlan on the switches (or voice-vlan). This will put the phones on a specific Vlan based on the MAC of your phones.

Now all data port and phone port will be technically identical and you can chain phones and computer, even using 2 different DHCP servers. Then you will just have to prevent L2 loop in your network.

Improve this answer
1
  • Thanks. I will make sure our HP switches have that kind option.
    – Will
    Nov 7, 2017 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.