1

Today my company had an annoying issue with DHCP looping. I spent more than 2 hours to figure out why several PCs get IPs from VOIP subnet. My manager spent about 30 minutes and figured out that someone plugged DATA port and VOIP port back of the phone. How do I prevent that so we don't have that kind of issue again? Does DHCP snooping prevent that type issue? if not, please let me know how to prevent that happen?

  • 2
    In a Cisco environment you can use switchport voice vlan option to separate data and voice. When you connect a Cisco IP phone the phone will get the voice vlan and the PC connected to the phone will get the data vlan. – user36472 Nov 2 '17 at 17:58
  • I'm not sure I understand what happened. Are you saying a user plugged their PC into the Voice switch port? What kind of phones are you using? – Ron Trunk Nov 2 '17 at 18:15
  • No, user plugged data wall port to the phone's data jack and the phone goes to VOIP jack. I hope it makes sense to you. – Will Nov 2 '17 at 18:22
  • @RonTrunk My guess is the voice and data VLANs are both untagged on the ports in question and the phone combined the two broadcast domains. – Todd Wilcox Nov 2 '17 at 18:36
  • Thanks Todd. That is correct. At our environment all ports are untagged. We are going to buy new switches, I will add tag for Voice but will it solve this issue? – Will Nov 2 '17 at 18:43
3

Without knowing a lot more about your infrastructure...

  1. Disable the "data" port on all your phones. You appear to have dedicated voice and data ports to everyone, so there's no need for daisy chaining through the phone.

  2. Enable what Cisco calls bpdu guard. If any spanning-tree BPDU is seen on an "edge" port, the port is immediately disabled.

  3. Running CDP / LLDP will help chase down what ports have been looped. If you see a switch neighbor on a port that shouldn't be connected to a switch...

  • Our phone doesn't have feature to disable data port. Our current swiches are 10 years old Netgear since our network is untagged so I guess previous IT did not buy switches that came with BDPU features. We are going to replace them with new HP switches. – Will Nov 2 '17 at 20:38
  • 1
    So, you have a perfect storm of the worst possible combination of technologies. (1) can't turn off the data port, (2) have no loop detection/prevention mechanisms, and (3) have almost no way to see what's plugged into to what. Thus... 1a super-glue the data port shut! (there are ethernet lock-out plugs -- I make my own by dry-crimping an RJ45 and then cutting the release arm off) – Ricky Beam Nov 3 '17 at 1:28
  • HP switches, by default, do not enable spanning tree. Turn it on. – Ron Trunk Nov 3 '17 at 18:25
  • Thanks Ricky, I like your comment. I'll super glue next time :) – Will Nov 7 '17 at 14:22
2

Since you are considering changing switches, you can use mac-based-vlan on the switches (or voice-vlan). This will put the phones on a specific Vlan based on the MAC of your phones.

Now all data port and phone port will be technically identical and you can chain phones and computer, even using 2 different DHCP servers. Then you will just have to prevent L2 loop in your network.

  • Thanks. I will make sure our HP switches have that kind option. – Will Nov 7 '17 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.