voip vlan with data vlan moving from vlan1 to vlan10

leblanc
leblanc used Ask the Experts™
on
Below is my current VoIP config on a Cisco 3750 with data vlan1 and voip vlan100
int gig1/0/1
description NEC VOIP
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 1,100

Now I want to move my data subnet from vlan1 to vlan20. So I have to add native vlan20 in my config.Correct?
int gig1/0/1
description NEC VOIP
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk native vlan 20
switchport trunk allowed vlan 1,100,20
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Hi,
switchport trunk native vlan 20
will set vlan 20 as "untagged" ... that's it.
Now you have the default, that is vlan 1 native.

you probably want to shutdown vlan 1 and then set
switchport trunk allowed vlan 100,20

this way you lose any track of vlan1 (which is desirable from security point of view).
You need to set that on all other uplinked switches.

hope this helps
max
leblancAccounting

Author

Commented:
Hi Max,

A little bit confused about your statement. You said that setiing native vlan 20 will set vlan20 as untagged. But then you said that now I have the default which is native vlan 1.

Is the config below correct if I move my data subnet from vlan1 to vlan20? Thx

int gig1/0/1
description NEC VOIP
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk native vlan 20
switchport trunk allowed vlan 100,20
Yes,exactly

i as well tried to explain that it is not mandatory to set native vlan as a used vlan. Cisco switches (and many others) have their default to default vlan1 and native vlan1.
When you shut down and disable vlan1, you may want to set trunk native vlan with another one, but this is not a must.
Basically, if you do, you're telling the switch that the frames traverse the trunk "untagged" for that particular vlan.
Cisco recommends that you set tha native vlan as an unused vlan (e.g. you create a dummy vlan, ex. vlan 4090 and set that as native) for security reason.
My opinion is that thare is no security breach and you can safely use native vlan 20 as you wrote above.

hope this clarify
max
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

leblancAccounting

Author

Commented:
I see. So from my understanding, when the VoIP phone boots up, it will go to the data vlan first to get the information necessary to get to the VoIP vlan. In my current case, the data vlan is in vlan 1. So it is working fine. So if I move my data subnet from vlan1 to vlan 20, I do not need to configure native vlan20 on my VoIP port configuration. Correct?
Well, that depends ...

to keep it the very same manner, since vlan1 was formerly the (default) native vlan, you'd better set native vlan 20 (the one that replaces vlan1). This way you keep the same rules you had before.

Just try it in console mode on the switch, so that you'll see in monitor what happens

max
leblancAccounting

Author

Commented:
Thanks

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial