Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

Securing voice vlans from data vlans

Hi there,

I am trying to secure IP phones on a voice vlan from the data vlans. CMs and Unity are on a third vlan.

I am building ACLs as specific as possible to control the trafic. I have isolated most UDP and TCP ports but I still have problems with dynamic ports with both the Attendant Console and the TFTP transfers.

1- Attendant Console:

From my latest sniffer traces using CCM 3.3.3sr3, I can see several specific ports:

PC to Pub using TCP 1101

PC to Pub/sub using TCP 2748

Sub/Pub to PC using a specified UDP port

The problem comes from another session on a TCP port that seems to be negociated within the TCP 1101 session. In my traces, the publisher sends a TCP port (ex: XXXX) in the data portion of the TCP 1101 session. Then the console PC initiates a session to PUB with that XXXX as the destination port.

Is there a way to make sure the negociated port (XXXX) is always the same or at least stays in a given range ??


Of course phone issue read requests from some high port to UDP 69. However the TFTP server sends the requested file from some UDP dynamic port to the UDP port that requested the file.

Is there some way of restricting the range of UDP ports use by the TFTP server to send the files??

My third problem may be IPCC express but I haven't had time yet to put the sniffer on it.

Thanx in advance for your inputs.



Re: Securing voice vlans from data vlans

You can check the below links which will be very useful for you to secure

Securing Networks with Private VLANs and VLAN Access Control Lists

Configuring Port Security

Configuring Port Security

Configuring Isolated Private VLANs on Catalyst Switches

Private VLAN Catalyst Switch Support Matrix

CreatePlease to create content