Voice VLANs and Power over Ethernet: configuring ports for IP phones

Why phones get their own VLAN

Voice traffic is small but very sensitive to delay and jitter. Keeping phones in their own VLAN and subnet makes it easy to give them priority, apply separate security rules and hand out addresses from a dedicated DHCP scope with phone-specific options. Most desk phones also have a second Ethernet port so that a PC can plug into the phone, which saves cabling and switch ports.

Configuring a voice VLAN

On Cisco switches the port stays an access port. You add a second, voice VLAN with one command:

vlan 10
 name DATA
vlan 20
 name VOICE
interface range GigabitEthernet1/0/1 - 44
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20
 spanning-tree portfast
 spanning-tree bpduguard enable
 power inline auto
show interfaces g1/0/1 switchport

The phone needs to know which VLAN to tag its traffic with. A Cisco switch tells Cisco phones through CDP (Cisco Discovery Protocol); phones from other vendors usually learn it through LLDP-MED (Link Layer Discovery Protocol for Media Endpoint Devices) or from a DHCP option. The phone then tags voice frames with VLAN 20 and a priority value, while the PC's frames stay untagged in VLAN 10. Voice is normally marked with DSCP EF; configure the switch to trust markings from phones but not from PCs, as described in QoS for voice and video. More on discovery protocols is in CDP and LLDP.

Power over Ethernet

Power over Ethernet (PoE) sends DC power along the same twisted-pair cable as the data, so phones, wireless access points and cameras need no local power supply. The switch is the PSE (power sourcing equipment) and the phone is the PD (powered device). Before sending power, the switch detects a PD signature on the cable, so ordinary laptops are never powered by mistake. The PD can then announce a power class, and LLDP or CDP can fine-tune the amount.

Some power is lost in the cable, so the device receives a little less than the switch sends. Cisco also has its own UPOE and UPOE+ variants for higher power. Use the power calculator under PoE budget when planning.

Managing the power budget

A switch can only deliver as much total power as its power supplies allow, which is often less than every port at full power. Check it with show power inline, which lists the available budget, what each port draws and its class. Useful interface commands are power inline auto (the default), power inline never for ports that should never supply power, power inline static max 30000 to reserve power for a critical device, and power inline port priority high on platforms that support priorities, so that phones keep power if the budget runs short.

Real-world example: a school adds access points

A primary school had 48 phones on one PoE switch with a 370 W budget. When the IT technician added six new Wi-Fi 6 access points on the same switch, two of them kept rebooting. show power inline showed the budget almost used up: the access points asked for PoE+ and the switch was refusing power to the last ports. The school added a second power supply to the switch, set the access point ports to high priority and moved two unused classroom ports to power inline never. The access points stayed up and the phones were unaffected.