This document describes the boot up process of IP phone and Voice VLAN concepts.
Voice Vlan Concepts
When VLANs were introduced a number of years ago, the concept was so radical and beneficial that it was immediately adopted into the industry. Nowadays, it is rare to find any reasonably sized network that is not using VLANs in some way.
VLANs allow you to break up switched environments into multiple broadcast domains. Here is the basic summary of a VLAN:
A VLAN = A Broadcast Domain = An IP Subnet
If a member of VLAN A sends a broadcast message, it goes to all VLAN A ports on both switches. The same holds true for VLAN B. To accommodate this, the connection between the switches must carry traffic for multiple VLANs. This type of port is known as a trunk port.
Trunk ports are often called tagged ports because the switches send frames between each other with a VLAN "tag" in place. It illustrates the following process:
HostA (in VLAN A) wants to send data to HostD (also in VLAN A). HostA transmits the data to SwitchA.
SwitchA receives the data and realizes that HostD is available through the FastEthernet 0/24 port (because HostD's MAC address has been learned on this port). Because FastEthernet 0/24 is configured as a trunk port, SwitchA puts the VLAN A tag in the IP header and sends the frame to SwitchB.
SwitchB processes the VLAN A tag because the FastEthernet 0/24 port is configured as a trunk. Before sending the frame to HostD, the VLAN A tag is removed from the header.
The tagless frame is sent to HostD.
Using this process, the PC never knows what VLAN it belongs to. The VLAN tag is applied when the incoming frame crosses a trunk port. The VLAN tag is removed when exiting the port to the destination PC. Always keep in mind that VLANs are a switching concept; the PCs never participate in the VLAN tagging process.
VLANs are not a Cisco-only technology. Just about all managed switch vendors support VLANs. In order for VLANs to operate in a mixed-vendor environment, a common trunking or "tagging" language must exist between them. This language is known as 802.1Q. All vendors design their switches to recognize and understand the 802.1Q tag, which is what allows us to trunk between switches in any environment.
Understanding Voice VLANs
It is a common and recommended practice to separate voice and data traffic by using VLANs. Separating voice and data traffic using VLANs provides a solid security boundary, preventing data applications from reaching the voice traffic. It also gives you a simpler method to deploy QoS, prioritizing the voice traffic over the data.
One initial difficulty you can encounter when separating voice and data traffic is the fact that PCs are often connected to the network using the Ethernet port on the back of a Cisco IP Phone. Because you can assign a switchport to only a single VLAN, it initially seems impossible to separate voice and data traffic. That is, until you see that Cisco IP Phones support 802.1Q tagging.
The switch built into Cisco IP Phones has much of the same hardware that exists inside of a full Cisco switch. The incoming switchport is able to receive and send 802.1Q tagged packets. This gives you the capability to establish a type of trunk connection between the Cisco switch and IP phone.
You might call the connection between the switch and IP phone a "mini-trunk" because a typical trunk passes a large number of VLANs (if not all VLANs). In this case, the IP phone tags its own packets with the correct voice VLAN (VLAN 25). Because the switch receives this traffic on a port supporting tagged packets (our mini-trunk), the switch can read the tag and place the data in the correct VLAN. The data packets pass through the IP phone and into the switch untagged. The switch assigns these untagged packets to whatever VLAN you have configured on the switchport for data traffic.
Traditionally, a switchport on a Cisco switch that receives tagged packets is referred to as a trunk port. However, when you configure a switchport to connect to a Cisco IP Phone, you configure it as an access port (for the untagged data from the PC) while supporting tagged traffic from the IP phone. So, think of these ports as "access ports supporting tagged voice VLAN traffic."
Configuring a Cisco switch to support Voice VLANs is a fairly simple process. First, you create VLANs to the switch
Enter configuration commands, one per line. End with CNTL/Z.
Sure enough, VLANs 25 (VOICE) and 50 (DATA) now appear as valid VLANs on the switch. Now that the VLANs exist, you can assign the ports attaching to Cisco IP Phones (with PCs connected to the IP Phone) to the VLANs.
Switch(config)#interface range fa0/2 - 24
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#switchport access vlan 50
Switch(config-if-range)#switchport voice vlan 25
When connecting Cisco IP Phones to a switch, you should also enable portfast (using spanning-tree portfast,), because the IP phones boot quickly and request a DHCP assigned address before a typical port with spanning-tree enabled would go active. Also, keep in mind that port Fa0/1 does not appear in the above figure output because it is configured as a trunk port (ports 2–24 are not considered trunks by Cisco IOS).
The ports are now configured to support a voice VLAN of 25 and a data VLAN of 50. This syntax is a newer form of configuration for IP Phone connections. In the "old days," you would configure the interface as a trunk port because the switch was establishing a trunking relationship between it and the IP phone. This was less secure because a hacker could remove the IP phone from the switchport and attach their own device (another managed switch or PC) and perform a VLAN-hopping attack. The more modern syntax configures the port as a "quasi-access port," because an attached PC will be able to access only VLAN 50. Only an attached Cisco IP Phone will be able to access the voice VLAN 25.
Keep in mind that Cisco IP phones will be able to receive this voice VLAN configuration from the switch via CDP. After it receives the voice VLAN number, the IP Phone begins tagging its own packets.
Understanding the Cisco IP Phone Boot Process
Here is the Cisco IP Phone boot process, start to finish:
The Cisco IP Phone connects to an Ethernet switchport. If the IP phone and switch support PoE, the IP phone receives power through either Cisco-proprietary PoE or 802.3af PoE.
On Phone: Mute, Headset, Speaker Buttons Are Illuminated
As the Cisco IP Phone powers on, the Cisco switch delivers voice VLAN information to the IP phone using CDP as a delivery mechanism. The Cisco IP Phone now knows what VLAN it should use.
Phone displays:“Configuring VLAN”
The Cisco IP Phone sends a DHCP request asking for an IP address on its voice VLAN.
Phone displays: “Configuring IP”(DNS is optional)
The DHCP server responds with an IP address offer. When the Cisco IP Phone accepts the offer, it receives all the DHCP options that go along with the DHCP request. DHCP options include items such as default gateway, DNS server information, domain name information, and so on. In the case of Cisco IP Phones, a unique DHCP option is included, known as Option 150. This option directs the IP phone to a TFTP server.
After the Cisco IP Phone has the IP address of the TFTP server, it contacts the TFTP server and downloads its configuration file.
The Cisco IP Phone attempts to contact the first call processing server (the primary server) listed in its configuration file to register. If this fails, the IP phone moves to the next server in the configuration file. This process continues until the IP phone registers successfully or the list of call processing agents is exhausted.
IP Phone Network Configuration
This video talks about the basics of Network configuration for your IP Phone to get your phone ready to work with Cisco Unified communications Manager