Voice VLANs on Cisco Catalyst Switches: Configuration, DHCP, and QoS Trust

A desk phone and the PC plugged into it usually share one switch port and one cable. Put them in the same VLAN and voice competes with every file copy on that subnet, phones take data DHCP addresses, and voice QoS and voice-only rules get messy. A voice VLAN fixes this without a second cable run: one access port carries PC traffic untagged in the data VLAN and phone traffic tagged in a separate voice VLAN, The examples use Cisco Catalyst 9300 / IOS XE syntax, with older IOS differences called out, and data VLAN 10 / voice VLAN 20 as examples only — substitute your own IDs and subnets.

What you need

• Admin access to the switch (console or SSH) and a saved copy of the running configuration
• Two VLANs with separate subnets — data and voice — plus a gateway for the voice subnet (an SVI here, or an upstream router / Layer 3 switch)
• A DHCP scope for the voice subnet, and your call-control address: CUCM TFTP for Cisco enterprise phones, or the provisioning server for SIP / multiplatform phones
• Your phone models and how they learn a voice VLAN: Cisco phones use CDP, most third-party phones use LLDP-MED, and a phone with neither needs its voice (admin) VLAN set manually
• A test phone and PC, and a change window

How a voice VLAN works

Three points explain most failures. First, a voice VLAN is a feature of an access port, not a trunk. The switch tells the phone, over CDP or LLDP-MED, to send voice tagged in VLAN 20; the phone tags its own traffic and passes PC traffic through untagged into the access VLAN. Cisco's 9300 guide is explicit: voice VLANs are supported on access ports only — trunks carry one onward, but switchport voice vlan does not belong on them.

Second, the phone learns its voice VLAN before it asks for an address, then sends its DHCP request inside that VLAN. DHCP therefore cannot assign the voice VLAN — if discovery fails, the phone comes up in the data VLAN and takes a data address, the most common symptom below. Third, the voice VLAN must exist and be active, and be allowed on uplinks toward the gateway, DHCP relay, and call control.

Create the VLANs

1. Enter global configuration: configure terminal
2. Create and name both VLANs: vlan 10 / name DATA, then vlan 20 / name VOICE.
3. Make sure voice has a gateway: an SVI such as interface vlan 20 with the voice gateway address on a Layer 3 switch, or the equivalent on your router.
4. On uplinks, confirm both VLANs are allowed — e.g. switchport trunk allowed vlan 10,20 — and exist upstream.
5. Verify first: show vlan brief should list VLAN 20 as active.

Configure the phone port

For one phone port (use interface range for a group):

1. interface gigabitethernet1/0/1
2. switchport mode access
3. switchport access vlan 10 — the data VLAN for the PC behind the phone.
4. trust device cisco-phone — on IOS XE, Cisco directs you to enable QoS trust before the voice VLAN; it trusts the phone's markings only when a Cisco phone is detected (conditional trust via CDP). AutoQoS, below, sets it for you. On older IOS switches (2960 / 3560 / 3750) the equivalents live under mls qos, with QoS on globally — check your platform's reference rather than pasting IOS XE lines into an IOS switch.
5. switchport voice vlan 20 — voice goes tagged in VLAN 20, at Layer 2 CoS 5 by default. (dot1p, none, and untagged are also accepted; they keep voice in or alongside the access VLAN and are not this design.)
6. switchport priority extend cos 0 — the phone overwrites the PC's priority to CoS 0 (the default), so a PC cannot claim voice priority. Use ... priority extend trust only deliberately.
7. spanning-tree portfast — on Catalyst 9300 / IOS XE, Cisco notes PortFast is enabled automatically with a voice VLAN; adding it is harmless there and needed by hand where it is not automatic.
8. end, verify (below), then save with copy running-config startup-config.

Warnings. Do not "fix" a phone port by making it a trunk — that breaks the model above. If you later enable port security on a voice port, allow for the phone as well as the PC: Cisco notes a phone here can use up to two MAC addresses, plus the PC's, so a maximum of one will shut the port down in normal use. And per Cisco's QoS guide, do not use the cisco-phone AutoQoS option below for phones that support video — it can overwrite video DSCP markings.

Reef stocks this design's gear, including the Catalyst 9300L 24-Port PoE+ switch (C9300L-24P-4X-E) and the Cisco 8851 3PCC, which learns its voice VLAN by LLDP-MED, not CDP.

DHCP for the voice VLAN

Build a separate DHCP scope for the voice subnet — network, gateway, DNS — plus one phone-specific option:

• Option 150 — Cisco enterprise (CUCM) phones read this TFTP option, which can carry multiple TFTP addresses. In an IOS pool: ip dhcp pool VOICE, network 192.168.20.0 255.255.255.0, default-router 192.168.20.1, option 150 ip 192.168.20.10 (examples).
• Option 66 — many SIP / multiplatform phones instead read this single-server provisioning option.

Set the option your phones actually read, in the voice scope only. Putting both options with different servers in one mixed scope is a known trap: a phone may take the other population's option and register against the wrong system. If the DHCP server is on another subnet, the voice gateway also needs a relay — ip helper-address <dhcp server> on the voice SVI / router interface — or the phone's broadcast never leaves VLAN 20.

QoS trust basics

• Trust the phone, conditionally. A Cisco phone marks voice at CoS 5 (signalling carries IP precedence 3). trust device cisco-phone, or AutoQoS, trusts those markings only while a Cisco phone is detected by CDP. That is the right default here.
• Do not extend trust through the phone. The priority extend cos 0 step keeps PCs from tagging their own traffic as voice.
• Carry trust across uplinks. QoS set only on the access switch is lost if the next device remarks traffic to zero. On uplinks to trusted switches or routers, trust incoming DSCP — e.g. AutoQoS auto qos voip trust — along the whole call path.
• AutoQoS is the shortcut. auto qos voip cisco-phone on a phone port generates the class maps, policy maps, and conditional trust for you; Cisco advises AutoQoS across the devices in the path, not just one. Verify with show auto qos interface <interface>. Exact commands differ by platform and release — your switch's QoS guide for its exact version wins.

Verify it worked

1. show interfaces gigabitethernet1/0/1 switchport — mode is access, Access Mode VLAN is 10, Voice VLAN is 20.
2. show vlan brief — VLAN 20 active.
3. show cdp neighbors detail (Cisco phone) or show lldp neighbors detail (LLDP-MED phone) — the phone should be discovered; no discovery usually means no voice-VLAN assignment either.
4. On the phone, confirm its address is from the voice subnet; confirm the PC still has a data address, then place a test call both ways.

If the phone lands in the wrong place

• Phone gets a data-VLAN address: discovery failed. Check the switchport voice vlan line is present, CDP is enabled on the port for a Cisco phone (on by default — look for it having been disabled) or LLDP-MED is running for a third-party phone, and no manual VLAN on the phone is overriding discovery.
• Phone gets no address: work the VLAN path — VLAN 20 not created/active, not allowed on the uplink, gateway down, no voice scope, missing ip helper-address, or exhausted scope.
• Voice address but no registration: it found DHCP but not call control. Check the scope's phone option — 150 for CUCM, 66 for most SIP phones — points at the right server, and the voice subnet can route to it.
• Calls sound poor under load: QoS is the gap — confirm conditional trust on phone ports and DSCP trust on every uplink, not just the first switch.
• Nothing helps: capture the switch model and software version, the show interfaces <port> switchport and neighbour outputs, and the phone model and firmware — Reef Support will start with those.