Voice VLANs: why bother separating

Putting phones on their own VLAN is standard practice, and it is worth understanding what it actually buys, because that determines how you configure it.

QoS becomes simple

With voice on its own subnet, classification is trivial: traffic from that subnet is voice. No deep inspection, no port ranges to maintain, no guessing. Every device in the path can classify correctly with one simple rule.

Without separation, you are matching on port ranges that change and trusting markings from devices that may be lying.

Trust boundaries become possible

A phone typically has a switch built in, with a PC behind it. The port carries voice on a tagged VLAN and data untagged. That allows a crucial distinction: trust the phone’s markings, ignore the PC’s.

interface GigabitEthernet0/5
 switchport access vlan 20          ! data, untagged
 switchport voice vlan 110          ! voice, tagged
 mls qos trust device cisco-phone
 mls qos trust dscp
 spanning-tree portfast

Without this, any workstation can mark its own traffic as priority and outrank everyone’s calls.

Security

Voice on its own VLAN can be filtered as a group. Phones need to reach the call manager and little else. That is a small, writable policy, and it limits what a compromised handset — or something plugged into a phone’s spare port — can reach.

Troubleshooting

An address tells you what a device is. Capturing all voice traffic becomes a subnet filter. Counting calls becomes a flow query. Every diagnostic gets easier when the traffic is identifiable by address.

DHCP and provisioning

A separate scope for voice supplies the provisioning server via DHCP options, and the scope size tells you how many handsets you can support. That is a useful constraint to have made visible rather than discovering it when the pool exhausts.

The one caution

Separate VLANs mean a router between voice and data. Ensure that path is not a bottleneck and that any firewall between them permits what the phones need, including the provisioning and time services that are easy to forget until a handset fails to boot.