In Cumulus Linux, a voice VLAN is a VLAN dedicated to voice traffic on a switch port. Voice VLAN is part of a trunk port with two VLANs that comprises either of the following: The voice traffic is an 802.1q-tagged packet with a VLAN ID (that might or might not be 0) and an 802.1p (3-bit layer 2 COS) with a specific value (typically 5 is assigned for voice traffic). Data traffic is always untagged. In this example configuration: To configure the topology shown above:
NCLU Commands cumulus@switch:~$ net add bridge bridge ports swp1-3
cumulus@switch:~$ net add bridge bridge vids 10,100,200,300
cumulus@switch:~$ net add bridge bridge pvid 10
cumulus@switch:~$ net add interface swp1 bridge voice-vlan 200
cumulus@switch:~$ net add interface swp2 bridge voice-vlan 200 data-vlan 100
cumulus@switch:~$ net add interface swp3 bridge voice-vlan 300 data-vlan 100
cumulus@switch:~$ net pending
cumulus@switch:~$ net commit
Edit the /etc/network/interfaces file and add the following configuration: TroubleshootingTo show the bridge VIDs, run the net show bridge vlan command: cumulus@switch:~$ net show bridge vlan Interface VLAN Flags ----------- ------ --------------------- swp1 10 PVID, Egress Untagged 200 swp2 100 PVID, Egress Untagged 200 swp3 100 PVID, Egress Untagged 300To obtain MAC address information, run the NCLU net show bridge macs command or the Linux sudo brctl showmacs <bridge> command. For example: cumulus@switch:~$ net show bridge macs VLAN Master Interface MAC TunnelDest State Flags LastSeen -------- -------- ----------- ----------------- ------------- --------- ------- ---------- untagged bridge bridge 08:00:27:d5:00:93 permanent 00:13:54 untagged bridge swp1 08:00:27:6a:ad:da permanent 00:13:54 untagged bridge swp2 08:00:27:e3:0c:a7 permanent 00:13:54 untagged bridge swp3 08:00:27:9e:98:86 permanent 00:13:54To capture LLDP information, check syslog or use tcpdump on an interface.
The terms Voice VLAN or Auxiliary VLAN typically mean the same thing: They are a feature which allows an access port — which normally only accepts untagged traffic for a single VLAN — to also accept tagged traffic for a second VLAN. But that is merely the “what”, and if you were simply looking for a definition, then the above is all you need. However, in order to really understand the concept, we have to look at the “why”, and also a bit of the history which brought about the Auxiliary VLAN. Doing so will reveal the use cases for the Voice VLAN or Auxiliary VLAN, as well as a particular use case for the Native VLAN. Before we get into the details, it is important to have a solid understanding of VLANs. Namely the purpose of VLANs, Access Ports, Trunk Ports, the Native VLAN, the configuration of VLANs, and the concept of a Converged Network. If these concepts are not familiar to you, start by reading the articles and videos which explain them. Also, the terms themselves are generally interchangeable. Voice VLAN is more often used in the Cisco context because of the command used to configure it, while Auxiliary VLAN is typically the name of the feature itself. Voice VLAN FunctionalityImagine office cubicles. Imagine each cubicle contains a desk and a computer which an employee uses to connect to your corporate network.  When this office floor was being built, network cables were ran through the walls and ceilings from each position on the cubicle floor to the network closet where the access switch for the corporate network exists. These cable runs are sometimes called “LAN drops” – a place an employee can connect locally (from their cubicle) into the corporate network switch (behind lock and key in the network cabinet). You end up with a topology that looks something like this (image not drawn to scale): Traditionally, there was one LAN drop for each cubicle. This was sufficient when employees only had one PC or Laptop to connect to the network. They would simply plug in locally at the cubicle, and the wall jack would lead back to the corporate network switch. The switchport would be configured as an access port in the VLAN associated with that employee’s role. The PC sends untagged data traffic, and the switch associates that traffic with the Data VLAN. On a Cisco switch, the configuration would resemble something like the following:
It is worth highlighting that (typically) PCs always send untagged traffic – this point will be important shortly. As time went on, phones which could carry Voice traffic over the IP network (VOIP phones) started being developed. Which leaves us with a problem — if a VOIP phone is added to each desk, where could you plug it in to get access to the corporate network? There is only one available wall jack and it is already in use by the PC. Voice and Data using two portsOne solution is to run a second LAN drop to each cubicle. This is the simplest solution from the networking perspective: One port is dedicated to carrying Data traffic, the other is dedicated to carrying Voice traffic. They are distinguished on the Switch using a simple access port in two different VLANs (the Data VLAN and the Voice VLAN):
Most modern office buildings now include multiple ports at each cubicle in order to account for multiple devices that need to be connected to the corporate network. Unfortunately, this wasn’t always an option for office’s which were not recently built. Voice and Data using one portA lot of older office build outs, which already only have one LAN drop at each cubicle, simply cannot afford the additional cost or delays to pay another technician to crawl through all the ceilings and walls to run another LAN drop to each cubicle. Which means the cubicles are limited to a single LAN drop per employee. VOIP phone manufacturers were able to foresee this problem, and created another solution built right into the VOIP phones themselves. The majority of VOIP phones come with two Ethernet ports: One meant to face the wall jack (and subsequently, the corporate LAN), the other meant to face a PC: Using these two ports, the PC can be connected to the phone, and the phone can subsequently be connected to the single wall jack. This allows both devices to share a single wall jack. The key is how to configure the switch, as now the single port will be receiving both Voice and Data traffic. We’ve already determined that Voice and Data traffic must be confined to distinct VLANs, but now both types of traffic are arriving on a single port. There are two solutions: One solution is to configure the port as a Trunk port. The other is to make use of the Auxiliary VLAN (or Voice VLAN) feature. Both solutions are discussed and compared below. Voice and Data using a Trunk port and the Native VLANTraditionally, if you want to carry traffic for multiple VLANs on a single port, you would configure a Trunk port. This would allow traffic for multiple VLANs to traverse the single link. But typically traffic on trunk ports require tagging to distinguish which bits belong to one VLAN and which bits belong to another VLAN. VOIP phones have the capacity to send and understand 802.1q VLAN tags, and can therefore be configured to send a VLAN tag for all the Voice traffic. PC’s, as we’ve already discussed, only send untagged traffic. As such, the switch must have a way to associate the received untagged traffic on the trunk port to a particular VLAN. This is the exact purpose of the Native VLAN. Therefore, in order to properly configure a single port to accommodate both a Voice and Data VLAN, you must first configure the interface as a Trunk port, then configure the Data VLAN as the Native VLAN:
Voice traffic will arrive from the VOIP phone with a tag for VLAN 33. And Data traffic will arrive from the PC untagged (forwarded untouched by the VOIP phone) and be associated to VLAN 22 because of the Native VLAN configuration. While on the surface, this solution does work, we have to go a step further. There are, in fact, two problems with using a Trunk port to carry both Voice and Data traffic. Problem #1: Configured as above, all VLANs on the switch will traverse the trunk linkIf there are only two VLANs configured on the switch (as above), then this isn’t really a problem. If however, you had more than just two VLANs configured, such as: Then traffic for all four VLANs would be sent down the trunk port. Leading to, at best, possible link saturation, or at worst, data leakage. The solution would be to add yet another configuration item to the interface to limit which VLANs are able to traverse the trunk port:
This will limit the VLANs which can traverse this trunk to only the necessary VLANs. Problem #2: The interface will not benefit from traffic optimizations that apply to Access portsSpanning tree has an optimization known as Portfast which speeds up how quickly an access port is enabled. Spanning tree also has an optimization known as BPDU guard which also (by default) only applies to access ports. Port Security (by default) only applies to access ports. There are other optimizations that exist for access ports that are tailored to ports facing network clients — like PC’s and VOIP phones. If the interface facing your VOIP phone and PC is configured as a trunk port, it will not be able to take advantage of the optimizations which exist for access ports. Of course, for each of these optimizations there are manual overrides that can be applied, but it increases the complexity of the network configuration. Besides, there is a much simpler solution to using a Trunk port for Voice and Data VLANs on a single port, and that solution is what this article has been building towards. The more optimal solution is to use the Auxiliary VLAN feature (also known as the Voice VLAN). Voice and Data using an Access port and the Auxiliary VLANsAnd so, we’ve finally come to the primary purpose of this article – to describe the specific problems that are solved by the Auxiliary VLANs feature. Namely, the problem serves as an answer to the following question (note: illustration is identical to the one above): In situations where only one physical port is available on your switch, how do you accept and receive Voice and Data traffic on one switchport while still keeping them in independent VLANs? The solution: First, use the VOIP phone’s built in switch – connect the PC to the phone, and the “LAN” port of the phone to the wall jack (which subsequently leads to the switchport). Second, use the Auxillary VLAN configuration to accept the tagged voice traffic from the VOIP phone, and untagged traffic from the PC:
With this configuration, traffic arriving on the single available switchport will still be accepted in two different VLANs on your network. Allowing you to separate Voice and Data traffic, despite it arriving on the same physical switchport. |
What is voice VLAN tag?
Postagens relacionadas
direito autoral © 2024 cemle Inc.
