New IP phone system, new subnet, add vlan

Posted on 2015-01-06
Last Modified: 2015-01-25
I am implementing a new phone system. First IP phone system. The company I am purchasing from suggested a new subnet and a vlan. I created the subnet. I do not currently have any vlans. I am trying to determine where to set it up. Here is my configuration...

Firewall, Cisco ASA
2 HP 48 port switches (data)
2 Luxul POE switches (phone)
I am not putting the phones through computer, they each have their own port/jack

I also need to determine how I want to figure the branch locations, here is that configuration

Site to Site VPN through Firewall
Cisco Router
HP switch (data)
POE switch (phone)
-one of the offices will use the same configuration as individual port/jack
-the other office will use the phone/computer pass through however they will not be setup immediately

Another note, I do not use DHCP.

How do I need to proceed?
Question by:Jennifer
  • 8
  • 3
LVL 42

Accepted Solution

kevinhsieh earned 200 total points
Comment Utility
The specifics depend on which specific Cisco routers you have. If your routers have multiple interfaces, it is possible to assign a new IP address on a new subnet to a port on your router and then plug in the PoE switch into the router. You wouldn't even need to create VLANs at the branches, though that is kind off the quick and dirty way to do it.

The more proper way is to create new L2 and L3 VLANs on your branch routers, create a new VLAN on the HP switch, and change the connection between the router and switch from a standard access port to a trunk port. You should then create another trunk port on the HP switch to be used as an uplink to the Luxul switch. Does the Luxel switch support VLANs? You would then need to configure the ports on the Luxel for the new VLAN that the phones will go on. You will need to configure the VPN to support the additional IP subnets that you will have.

Do you have a router at the main office, or just the ASA? Whichever layer 3 device that is connected to the HP switches will need to have the new VLAN created, the connection converted to trunk, new VLAN on the HP switches created, and the Luxel switches connected.

This is just a high level overview. It's a reasonably big job, especially since you aren't using any VLANs now. You need to do this on site as it's fairly easy to get the trunk connections wrong the first time which means your switch won't be able to talk to your router.

The site with the computer and phone on the same site will require more advanced configuration on the switch to get the phone and computer onto different VLANs. That involves coordination between the phone and switch, possibly using a protocol called LLDP. You will need to consult your documentation.

If it all possible, I suggest getting a local resource that has done this kind of thing before.

Author Comment

Comment Utility
Thanks for the info, a lot to take in. I will break it down on what I need now and maybe that will help us both.

Main office, Cisco ASA 5510 (router/firewall)
I have two HP switches, I previously had a VLAN on one
(this is my normal setup)
I have a new Toshiba IPEdge phone server coming
It will connect to the two Luxul POE switches (I will have to look into the Luxul switches, I don't know much about them at this point (our company sells them and my boss wanted me to put them in))

Now I need to connect the Luxul's to my network using the HP switches

The company putting in our phone system is the one suggesting the VLAN. I have created the subnet. I can create the VLAN I just wasn't sure where to create it.

The company putting in the phone system will be onsite and hooking it up as well I just need to be prepared. Then I can configure for the branches.
LVL 42

Expert Comment

Comment Utility
You will need to configure the L2 VLAN on every piece of equipment where data from that VLAN will be traveling. That means all of the local switches and the ASA. The ASA will route traffic from the voice VLAN to your other data VLAN as required.

The ASA will need some configuration to allow it to route between the two VLANs. See (I haven't read the whole thing, so be sure you understand any proposed changes before you put them in). You will certainly need to enable hair pinning on the same interface.

Author Comment

Comment Utility
Separate question before I go further, would it make a difference if I used the IP pass through on the phones instead of its own IP and sub?
LVL 42

Expert Comment

Comment Utility
Well, there are two ways to use the passthrough. If you have the phones on the same VLAN and subnet as you do currently, that is very simple and all you need to do is uplink your switches and go.

If you want to have the phones on a separate VLAN and IP subnet as the PC, then using the passthrough is more complicated because the phone and the switch need to be configured to communicate with each other via LLDP, and the switch needs to know that phones go on a separate voice VLAN. It's completely doable, but I suggest that you get one part working at a time.
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!


Assisted Solution

Jennifer earned 0 total points
Comment Utility
Can someone go through this again with me, lets start with just my switches, here is what I have...
I have one Cisco ASA5510  my ASA is only plugged into HP-1
     - just a note, both HP's are Procurves and Luxul's are XMS-1008P POE's
I have one HP-1 gbic to second HP-2 (servers and pcs)
I have Lux-1 port connect to Lux-2 (phones)

I was under the impression that I need one connection between HP-1 and Lux-1
I have one vlan on HP-1 with one port 45 (tgig) tagged

The HP-1 has a subnet of (for ex. so the HP's are and
I have a separate subnet for Lux's 1 and 2 so and

so with this do I only need to connect HP-1 to Lux-1

Author Comment

Comment Utility
Also, this is all internal, nothing external yet, about 45 machine users but about a quarter of that is light usage then 35 phones

Author Comment

Comment Utility
I have to correct a previous statement. One of my HP's is being used as my gateway.

Assisted Solution

Jennifer earned 0 total points
Comment Utility
Here is what I have so far...

HP1 - (gateway and switch 1)
-vlan1 (default) no tagged on port 45, all others are untagged
-vlan2 (voice) tagged port 45

Luxul1 -
-vlan (default) untagged 1-24
-vlan 2 (voice) has built in voice vlan under QOS, put in vlan 2 I created, set VoIP as enabled, priority as 6

I can access HP1 from any computer. I can access Luxul1 but only after I give my computer an ip address from the luxul range. I need to be able to access the luxul1 from any computer no matter the gateway. How do I setup remote to get access to the Luxul? (I am able to do this with my branch routers)

Assisted Solution

Jennifer earned 0 total points
Comment Utility
I need a bit of help with the VLANs I think because I am not sure they are communicating. I have the following on the Procurve. What am I missing...

Running configuration:

; J4904A Configuration Editor; Created on release #I.10.43

hostname "Procurve Switch 1"
qos dscp-map 101110 priority 6
interface 45
   name "VOICE"
ip default-gateway
ip routing
snmp-server community "public" Unrestricted
snmp-server host "public"
vlan 1
   name "DEFAULT_VLAN"
   untagged 1-44,46-48
   ip address
   no untagged 45
vlan 2
   name "Voice"
   untagged 45
   no ip address
qos tcp-port 45 dscp 101110
qos device-priority dscp 101110
ip route

Also, I was just told that the fiber for phone comes in on an adtran. Does the adtran go to my ASA and from what IP address subnet would I give it?

My Luxul can be configured pretty much the same as the Procurve although it does have a builtin Voice Vlan under Qos. which way would I configure? All ports will be phone except the port connecting to the Procurve.

Author Closing Comment

Comment Utility
I was able to get my configuration with the help of an outside consultant. I will partial points for posting with help.

Featured Post

Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Nexus OS - OSPF Command 3 28
WAN IP Conflict on Sonicwall 5 57
Extending  a subnet 9 34
What's the problem with my DSL? 4 18
Don’t let your business fall victim to the coming apocalypse – use our Survival Guide for the Fax Apocalypse to identify the risks and signs of zombie fax activities at your business.
If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now