Voice VLAN

In this lesson, we’ll take a look at the Voice VLAN and how it works..

Usually, IP phones sit next to a computer on the same desk. They require the same UTP cables as computers and also use Ethernet. If we want to connect them to a switch, we have two options.

You could connect the computer and IP phone using two different cables:

switch ip phone host two cables

This will work but it has some disadvantages:

  • You need to install a new cable from the switchport to the IP phone.
  • You will lose a switchport for the IP phone.

To solve this, most IP phones (including Cisco) have a three port switch inside of the IP phone:

  • One port connects to the switch.
  • One port connects to the computer.
  • One (internal) port connects to the phone.

This allows us to connect the IP phone and computer like this:

switch host behind ip phone

You probably want to separate the data from the computer and IP phone. This is something we can do with voice VLANs.

The Voice VLAN is also known as the Auxiliary VLAN (AUX VLAN)

The computer will be in a data VLAN, the IP phone will be in the voice VLAN. It will look like this:

switch host ip phone voice vlan

Behind the scenes, we have a trunk between our switch and IP phone. The port on the IP phone that connects to the computer is an access port. The IP phone will forward all traffic from the computer to the switch untagged, traffic from the IP phone itself will be tagged. The only two VLANs that are allowed though, are the access and voice VLAN.


If you are familiar with the configuration of VLANs then configuring a voice VLAN is very simple. Let’s configure a switchport where we use VLAN 100 for the computer and VLAN 101 for our IP phone.

First, we have to create the two VLANs:

SW1(config)#vlan 100
SW1(config-vlan)#name COMPUTER

SW1(config)#vlan 101
SW1(config-vlan)#name VOIP

Now we can configure the interface:

SW1(config)#interface GigabitEthernet 0/1
SW1(config-if)#switchport mode access
SW1(config-if)#switchport access vlan 100
SW1(config-if)#switchport voice vlan 101

We configure the interface in access mode and use VLAN 100 for the computer. The switchport voice vlan command tells the switch to use VLAN 101 as the voice VLAN.

We configured the switch but how does the IP phone know which VLANs to use? Cisco IP phones use CDP (Cisco Discovery Protocol) for this. The IP Phone will learn through CDP which VLANs it should use. Other IP phones sometimes use LLDP (Link Laye Discovery Protocol) for this.


Let’s verify our work. You have to use the show interfaces command for this:

SW1#show interfaces GigabitEthernet 0/1 switchport
Name: Gi0/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: negotiate
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 100 (COMPUTER)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: 101 (VOIP)
Administrative private-vlan host-association: none 
Administrative private-vlan mapping: none 
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk associations: none
Administrative private-vlan trunk mappings: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL

Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled
Appliance trust: none

Above you can see that we are using VLAN 100 for the Computers and VLAN 101 for the IP phones.

We can also take a look at the trunk status. Although this will show us that the interface is not-trunking, it does tell us the two VLANs that are used:

SW1#show interfaces GigabitEthernet 0/1 trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi0/1      off              negotiate      not-trunking  1

Port        Vlans allowed on trunk
Gi0/1      100-101

Port        Vlans allowed and active in management domain
Gi0/1      100-101

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1      100-101

Above we see that VLAN 100 and 101 are allowed on this interface. Although it shows up as non-trunking, keep in mind that in reality, this is a trunk.


In this lesson you have learned how to configure the Voice VLAN and how to verify your work. If you have any questions, feel free to leave a comment in our forum.


Forum Replies

  1. Hi ,

    As i understand the IP PHONE working as a switch and separate traffic between voice and data and the connections between IP PHONE-COMPUTER and IP PHONE-VOICE(PHONE) are like access port and tagged with corresponding vlan that learning with cdp from the switch and then send to the trunk port . Is it wright ?
    Please let me now



  2. Hi Rene,

    So does that mean even though we configure ‘switch-port mode access’ , but for VOICE VLAN that same port works as trunk port because it carries 2 VLAN?


  3. Hello Dionisis

    Yes you are correct in your description. Any traffic coming from the PC through the phone will be untagged and will go to the access VLAN configured on the port of the switch. All voice traffic is tagged and will go to the voice vlan configured on the port of the switch.

    Keep in mind that the voice vlan configuration not only configures the appropriate VLANs for data and voice, but also sends voice traffic with a QoS based on IEEE 802.1p CoS. In other words, a Quality of Service technique is automatically incorporated into the functionality of

    ... Continue reading in our forum

  4. Hello Abhishek

    In the past, before the advent of the switchport voice vlan command you would have to configure a port as a trunk port that included both the voice and data VLANs. It was around 10 years ago when I was first learning about Cisco IP telephony where we would use such a configuration. Back then, connections to IP phones were literally trunks.

    Today however, we use ports configured with voice VLANs. Such a port will have both the switchport mode access command as well as the switchport voice vlan command. So is this an access port or a trunk?


    ... Continue reading in our forum

  5. Hi Rene,

    How does switch differentiate between DATA traffic and VOICE traffic ? Consider IP phone is non-cisco

28 more replies! Ask a question or join the discussion by visiting our Community Forum