4

We have multiple interfaces currently configured with the below on our Cisco 3750x switch.

interface GigabitEthernet1/0/21
 switchport access vlan 4
 switchport trunk encapsulation dot1q
 switchport mode access
 switchport voice vlan 3
 spanning-tree portfast

Connected to these interfaces is a Shoretel phone and there is a port from the Shoretel phone that connects to a laptop or desktop. Our workstation VLAN is VLAN 4 and our Voice VLAN is VLAN 3 as you can see above. We are running DHCP pools within our switch which has the option 156 associated so that the phone will know what VLAN to pickup.

ip dhcp pool VOICE
 network 10.7.8.0 255.255.248.0
 option 4 ip 192.168.32.215
 default-router 10.7.8.1
 dns-server 10.7.0.101 192.168.30.205
 domain-name --omitted--
 option 156 ascii "ftpservers=10.7.8.9,layer2tagging=1,vlanid=3"
 lease 0 1
!

Questions:

What is the point of switchport trunk encapsulation dot1q within the interface configuration?

Also, is spanning-tree portfast really needed? We are not running spanning tree on our switch.

Why separate access and voice vlan? What is the purpose?

4

802.1Q tagging allows you to run multiple VLANs over a single, physical link. With phones, often the normal PC client VLAN remains untagged (access VLAN) while the VoIP VLAN is tagged.

Using a DHCP vendor option to tell the phones to use tagged VLAN x is a good method to avoid configuring each phone manually. You should consider to limit this option to phones though (by MAC filter or vendor class), so a potential attacker has a harder time figuring out which VLAN to enter.

"Best practice" for my company is to not use the phone-integrated switches productively but run separate cables to the phones and the PC clients. The phone "through" port remains active as spare access to the client access VLAN.

The switchport trunk encapsulation dot1q enables 802.1Q tagging on the switch port.

spanning-tree portfast isn't really required but significantly decreases the delay between the port's physical link "up" and actual forwarding. STP port states usually delay forwarding until the port role has become clear. portfast starts forwarding immediately and still uses STP to discover redundant links, avoiding bridge loops.

Separate access and voice VLANs have several purposes. For one, separating the device types allows you to more easily prioritize voice traffic, so network congestion has no or less impact on VoIP. Additionally, separating traffic hinders listening in to the (mostly) unencrypted VoIP traffic or attacking the phones directly. When combined with port-level authentication (e.g. 802.1X or MACSEC) or similar measures this can be rather secure.

| improve this answer | |
  • Any "attacker" will know the voice vlan from the first broadcast packet, without ever sending anything. – Ricky Jun 7 '19 at 17:32
  • @RickyBeam ... when he's already listening to tagged frames. Filtering for phones doesn't make the VLAN show up right away when someone connects. Admittedly, a serious attacker has no problem at all with that, but an automated attack might get harder or delayed that way. For serious security you'd need port-level authentication, of course. – Zac67 Jun 7 '19 at 17:56
  • 5
    erm... just nitpicking: switchport trunk encapsulation dot1q does not activate VLAN tagging; it only defines the tagging mode on platforms still supporting both ISL and 802.1q. Younger Cisco platforms without ISL support (only 802.1q) don't even support that command anymore. VLAN tagging gets activated either explicitely by switchport mode trunk or by another method (such as DynamicTrunkingProtocol) or semi-explicitely by switchport voice vlan .... – Marc 'netztier' Luethi Jun 7 '19 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.