New IP phone system, new subnet, add vlan

I am implementing a new phone system. First IP phone system. The company I am purchasing from suggested a new subnet and a vlan. I created the subnet. I do not currently have any vlans. I am trying to determine where to set it up. Here is my configuration...

Firewall, Cisco ASA
2 HP 48 port switches (data)
2 Luxul POE switches (phone)
I am not putting the phones through computer, they each have their own port/jack

I also need to determine how I want to figure the branch locations, here is that configuration

Site to Site VPN through Firewall
Cisco Router
HP switch (data)
POE switch (phone)
-one of the offices will use the same configuration as individual port/jack
-the other office will use the phone/computer pass through however they will not be setup immediately

Another note, I do not use DHCP.

How do I need to proceed?
JenniferIT DirectorAsked:
Who is Participating?
The specifics depend on which specific Cisco routers you have. If your routers have multiple interfaces, it is possible to assign a new IP address on a new subnet to a port on your router and then plug in the PoE switch into the router. You wouldn't even need to create VLANs at the branches, though that is kind off the quick and dirty way to do it.

The more proper way is to create new L2 and L3 VLANs on your branch routers, create a new VLAN on the HP switch, and change the connection between the router and switch from a standard access port to a trunk port. You should then create another trunk port on the HP switch to be used as an uplink to the Luxul switch. Does the Luxel switch support VLANs? You would then need to configure the ports on the Luxel for the new VLAN that the phones will go on. You will need to configure the VPN to support the additional IP subnets that you will have.

Do you have a router at the main office, or just the ASA? Whichever layer 3 device that is connected to the HP switches will need to have the new VLAN created, the connection converted to trunk, new VLAN on the HP switches created, and the Luxel switches connected.

This is just a high level overview. It's a reasonably big job, especially since you aren't using any VLANs now. You need to do this on site as it's fairly easy to get the trunk connections wrong the first time which means your switch won't be able to talk to your router.

The site with the computer and phone on the same site will require more advanced configuration on the switch to get the phone and computer onto different VLANs. That involves coordination between the phone and switch, possibly using a protocol called LLDP. You will need to consult your documentation.

If it all possible, I suggest getting a local resource that has done this kind of thing before.
JenniferIT DirectorAuthor Commented:
Thanks for the info, a lot to take in. I will break it down on what I need now and maybe that will help us both.

Main office, Cisco ASA 5510 (router/firewall)
I have two HP switches, I previously had a VLAN on one
(this is my normal setup)
I have a new Toshiba IPEdge phone server coming
It will connect to the two Luxul POE switches (I will have to look into the Luxul switches, I don't know much about them at this point (our company sells them and my boss wanted me to put them in))

Now I need to connect the Luxul's to my network using the HP switches

The company putting in our phone system is the one suggesting the VLAN. I have created the subnet. I can create the VLAN I just wasn't sure where to create it.

The company putting in the phone system will be onsite and hooking it up as well I just need to be prepared. Then I can configure for the branches.
You will need to configure the L2 VLAN on every piece of equipment where data from that VLAN will be traveling. That means all of the local switches and the ASA. The ASA will route traffic from the voice VLAN to your other data VLAN as required.

The ASA will need some configuration to allow it to route between the two VLANs. See (I haven't read the whole thing, so be sure you understand any proposed changes before you put them in). You will certainly need to enable hair pinning on the same interface.
Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

JenniferIT DirectorAuthor Commented:
Separate question before I go further, would it make a difference if I used the IP pass through on the phones instead of its own IP and sub?
Well, there are two ways to use the passthrough. If you have the phones on the same VLAN and subnet as you do currently, that is very simple and all you need to do is uplink your switches and go.

If you want to have the phones on a separate VLAN and IP subnet as the PC, then using the passthrough is more complicated because the phone and the switch need to be configured to communicate with each other via LLDP, and the switch needs to know that phones go on a separate voice VLAN. It's completely doable, but I suggest that you get one part working at a time.
JenniferIT DirectorAuthor Commented:
Can someone go through this again with me, lets start with just my switches, here is what I have...
I have one Cisco ASA5510  my ASA is only plugged into HP-1
     - just a note, both HP's are Procurves and Luxul's are XMS-1008P POE's
I have one HP-1 gbic to second HP-2 (servers and pcs)
I have Lux-1 port connect to Lux-2 (phones)

I was under the impression that I need one connection between HP-1 and Lux-1
I have one vlan on HP-1 with one port 45 (tgig) tagged

The HP-1 has a subnet of (for ex. so the HP's are and
I have a separate subnet for Lux's 1 and 2 so and

so with this do I only need to connect HP-1 to Lux-1
JenniferIT DirectorAuthor Commented:
Also, this is all internal, nothing external yet, about 45 machine users but about a quarter of that is light usage then 35 phones
JenniferIT DirectorAuthor Commented:
I have to correct a previous statement. One of my HP's is being used as my gateway.
JenniferIT DirectorAuthor Commented:
Here is what I have so far...

HP1 - (gateway and switch 1)
-vlan1 (default) no tagged on port 45, all others are untagged
-vlan2 (voice) tagged port 45

Luxul1 -
-vlan (default) untagged 1-24
-vlan 2 (voice) has built in voice vlan under QOS, put in vlan 2 I created, set VoIP as enabled, priority as 6

I can access HP1 from any computer. I can access Luxul1 but only after I give my computer an ip address from the luxul range. I need to be able to access the luxul1 from any computer no matter the gateway. How do I setup remote to get access to the Luxul? (I am able to do this with my branch routers)
JenniferIT DirectorAuthor Commented:
I need a bit of help with the VLANs I think because I am not sure they are communicating. I have the following on the Procurve. What am I missing...

Running configuration:

; J4904A Configuration Editor; Created on release #I.10.43

hostname "Procurve Switch 1"
qos dscp-map 101110 priority 6
interface 45
   name "VOICE"
ip default-gateway
ip routing
snmp-server community "public" Unrestricted
snmp-server host "public"
vlan 1
   name "DEFAULT_VLAN"
   untagged 1-44,46-48
   ip address
   no untagged 45
vlan 2
   name "Voice"
   untagged 45
   no ip address
qos tcp-port 45 dscp 101110
qos device-priority dscp 101110
ip route

Also, I was just told that the fiber for phone comes in on an adtran. Does the adtran go to my ASA and from what IP address subnet would I give it?

My Luxul can be configured pretty much the same as the Procurve although it does have a builtin Voice Vlan under Qos. which way would I configure? All ports will be phone except the port connecting to the Procurve.
JenniferIT DirectorAuthor Commented:
I was able to get my configuration with the help of an outside consultant. I will partial points for posting with help.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.