Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

1841 ISR VLANs Across Physical Interfaces


Our network setup looks like the following:-

ASA 5510 --->> E0/1 (1841 ISR) E0/0 --->> VLANS / Catalyst Switch

We've recently added ASAs to our network. Our intention is to setup a VPN tunnel to our branch office. The head office setup shown above has many VLANs on the E0/0 interface one of which is a voice VLAN that handles our VoIP phone system traffic.

When we setup the VPN tunnel, we want to have the voice VLAN available at the branch office.

How would I go about doing this?

Currently the E0/1 interface of the ISR is configured with the IP address The ASA's IP address for the lan/inside interface is

Would I need to configure the ISR's E0/1 interface for sub interfaces instead?

  • LAN Switching and Routing
Cisco Employee

Re: 1841 ISR VLANs Across Physical Interfaces


The question is whether you need to actually span this voice VLAN over your 1841, or whether there can be another IP subnet (a VLAN or just another routed LAN) devoted as the voice VLAN for your branch offices. As the voice VLAN is effectively terminated on your 1841 E0/0, even creating subinterfaces on the E0/1 alone will not help because these two ports will still be separated by a router internally. The VLAN IDs may be the same but they are still made separate and independent of each other because of a router interconnecting them.

If the voice VLAN has to be effectively extended over your 1841 then I can imagine configuring an IRB bridge between your E0/0.X and E0/1.X interface (X meaning the voice VLAN you are currently using) and so extend this VLAN towards the ASA. I do not think however that this is a best practice design.

Also, is the VPN between your head office and the branch office working as Layer2 or Layer3 VPN? My question relates to the fact whether there is actual routing involved inside the VPN for the branch office to reach the head office. If yes then there is no point in extending the VLAN anyway. The basic question here is whether the VLAN must really span into the branch office, or whether the branch offices can have their own voice VLAN and route the voice data towards the voice VLAN on your central location.

Best regards,


New Member

Re: 1841 ISR VLANs Across Physical Interfaces

Thanks for the reply.

The VPN between the head office and the branch office will be IPSEC L2L. It's not setup on the ASAs as yet as the old firewall hardware is still in place.

Currently at the head office, the VoIP phones are connected to Catalyst switches. Each port on the Catalysts that have a phone connected to it has a configuration like this:


interface GigabitEthernet0/1

switchport access vlan 3

switchport mode access

switchport voice vlan 2

switchport priority extend trust

mls qos trust cos

spanning-tree portfast


I'll double check and see whether the phones can be manually programmed since that's the only way it would work if the VLAN isn't trunked across the VPN.