Voice VLANs

Configure one switch port to carry a data VLAN for a PC and a voice VLAN for an IP phone at the same time, and verify both memberships on a port that is still an access port.

What you'll learn (4 objectives)~14 min: video → lesson → check → apply → lab prep

Learning objectives

Explain the operational difference between an access (data) VLAN and a voice VLAN on the same port
Describe how an IP phone learns its voice VLAN and tags its own call traffic
Configure switchport access vlan and switchport voice vlan on a phone port
Verify the dual-VLAN result with show interfaces switchport and show vlan brief

Terms you will see

Voice VLANData VLANLLDP-MEDQoS markingVoice overlay

Time breakdown

Read the notes9 min
Configuration prediction5 min

Why voice gets its own VLAN

Call traffic and PC traffic should not share a broadcast domain. A separate voice VLAN buys two things. Security separation means the PC cannot easily capture the phone's call packets. QoS priority means voice frames can be marked and queued ahead of best-effort data, which is what keeps calls intelligible when the link is busy. It also keeps voice addressing — its own subnet and DHCP scope — cleanly apart from the data network, which is the VLAN-per-subnet idea from Lesson 2 applied to phones.

One access port, two VLANs

This is the part that feels like a contradiction after the last two lessons. An access port carries one data VLAN — yet a phone port carries a data VLAN and a voice VLAN. It is still not a trunk. The mechanism is a special case built into the phone.

The PC behind the phone sends ordinary untagged frames, which the switch places in the access (data) VLAN, exactly like any other access host.
The phone tags its own call traffic with the voice VLAN ID. The switch told the phone which VLAN to use, so the phone does the tagging itself.

Because only the phone tags, and everything else on the port is untagged data, the port stays an access port with a voice overlay rather than becoming a general-purpose 802.1Q trunk carrying arbitrary VLANs.

How the phone learns its voice VLAN

The switch advertises the voice VLAN to the attached phone over CDP, or over the open LLDP-MED extension in a mixed-vendor environment. The phone does not need to be pre-configured — it hears the VLAN from the switch and starts tagging accordingly. CDP and LLDP are the subject of the final lesson this week, and this is one of the two places you have now met CDP doing real work.

Why not simply trunk to the phone?

Historically you could, and some designs did. The voice-VLAN feature is cleaner and safer: it grants exactly one extra tagged VLAN on top of one untagged data VLAN, without turning the port into a full trunk that could carry — or negotiate — other VLANs. Less surface, less to misconfigure, and the phone auto-learns the VLAN. That is why CCNA teaches switchport voice vlan rather than trunking to phones.

Configure and verify a phone plus PC port

One access port carrying data (PC) and voice (phone)

Switch(config)# interface FastEthernet0/10
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10     ! data VLAN for the PC
Switch(config-if)# switchport voice vlan 110     ! voice VLAN for the phone

Switch# show interfaces FastEthernet0/10 switchport
Switch# show vlan brief

show interfaces <port> switchport is the confirmation that matters. It reports the port in static access mode, an Access Mode VLAN of 10, and a Voice VLAN of 110 — two memberships on a port that is still administratively an access port. show vlan brief lists the port under the data VLAN only; the voice membership appears in the per-interface switchport detail rather than as a second access assignment, which is why the per-port command is the one to reach for.

What you should retain

A phone port is an access port with a voice overlay, not a trunk.
The PC's traffic is untagged and lands in the data VLAN; the phone tags its own traffic into the voice VLAN.
The phone learns the voice VLAN from the switch via CDP or LLDP-MED.
Configure with switchport access vlan <data> and switchport voice vlan <voice>.
Verify with show interfaces <port> switchport, which shows both Access Mode VLAN and Voice VLAN.

Pause and predictNot scored — nothing is recorded

Before you read on

A technician configures switchport access vlan 10 on a phone port but forgets switchport voice vlan 110. The phone powers up and gets an IP address, so it looks fine. What is actually wrong, and how would show interfaces <port> switchport reveal it?

Section quiz

Check this section before moving on

Required8 questions~10 min

Trunking & Voice VLANs

The quiz opens on its own page so you can focus on it. It is a Week 1 milestone, tracked separately from this lesson's own completion.

Topics covered

• 802.1Q tagging and the native VLAN
• Native-VLAN mismatch versus allowed-list mismatch
• DTP modes and why two autos never trunk
• The phone-plus-PC port and its two VLANs

Start the quiz

Study deeper

Topic guides extend this lesson — they do not replace the first-party walkthrough above.

VoIP & Voice VLANs

For the voice-VLAN rationale in depth, plus Power over Ethernet and the phone boot process this lesson does not cover

Open guide

Lesson orientation