Voice VLAN: How a Cisco Phone and a PC Share One Switch Port

A Cisco IP phone with a PC plugged into its pass-through port is served by an ordinary access port carrying one extra command. The access VLAN holds the PC’s traffic, and switchport voice vlan <id> tells the switch to advertise a separate VLAN ID to the phone. The phone applies an 802.1Q tag with that ID to its own voice frames, while the PC keeps sending completely untagged frames that the switch drops into the access VLAN. The port stays an access port throughout, and the whole arrangement depends on the phone learning the voice VLAN ID over CDP (Cisco Discovery Protocol) or LLDP-MED (Link Layer Discovery Protocol, Media Endpoint Discovery).

The configuration

SW1(config)# vlan 110
SW1(config-vlan)# name VOICE
SW1(config-vlan)# exit
SW1(config)# interface GigabitEthernet1/0/12
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# switchport voice vlan 110

Three of those four interface-level facts each carry weight. switchport mode access fixes the administrative mode, which stops the port from ever negotiating a trunk with DTP against whatever device is plugged in. switchport access vlan 10 decides where untagged frames land. switchport voice vlan 110 is the only command in IOS that establishes a voice VLAN, and it is a per-port property. There is no switchport access vlan 110 voice, no bare voice vlan 110 interface subcommand, and no trunk variant of the command.

Creating VLAN 110 explicitly is optional for traffic to flow, because switchport voice vlan 110 auto-creates a missing normal-range VLAN. What auto-creation cannot do is name it. An implicitly created VLAN receives the default name VLAN0110, so any requirement that specifies a name forces the explicit vlan and name pair.

Two variants exist. switchport voice vlan dot1p tells the phone to tag with VLAN ID 0, which carries class-of-service priority bits but no VLAN assignment, so voice frames land in the access VLAN with priority marking intact. switchport voice vlan none leaves the phone to send untagged frames like any other device.

How the phone learns the VLAN

The switch does not force anything onto the phone. It advertises the voice VLAN ID inside a discovery protocol message, and the phone reads that advertisement and configures itself. CDP is Cisco’s proprietary neighbor-discovery protocol, enabled by default on Catalyst switches, sending advertisements every 60 seconds with a 180 second holdtime. LLDP is the IEEE 802.1AB equivalent with 30 second advertisements and a 120 second holdtime, disabled by default on Catalyst switches and enabled globally with lldp run; LLDP-MED is the extension that carries endpoint policy including the voice VLAN. The two protocols are compared field by field in CDP versus LLDP.

Once the phone has that information, three streams share the wire:

• Voice frames from the phone, 802.1Q-tagged with VLAN 110.
• The phone’s own signaling and management traffic, also tagged with VLAN 110.
• Frames from the PC behind the phone, untagged and passed straight through, landing in VLAN 10.

The switch separates voice from data purely by the presence and value of that tag. It does not classify by MAC address, by device type, or by any inspection of the payload. Nothing on the PC needs to be VLAN-aware, which is the entire reason the phone sits in the middle.

That dependency creates the signature failure: if both CDP and LLDP-MED are disabled on the port, the phone receives no instruction, sends its voice traffic untagged, and the switch places it in the data VLAN. The phone then picks up an address from the data DHCP (Dynamic Host Configuration Protocol) scope instead of the voice scope. Every VLAN-layer detail looks correct in the configuration because the fault sits in the discovery layer. Restore CDP with cdp run globally and cdp enable on the interface, or LLDP with lldp run plus lldp transmit and lldp receive.

Access port with a voice VLAN versus a trunk

Attribute	Access port with voice VLAN	Trunk port
Command that defines it	switchport mode access plus switchport voice vlan	switchport mode trunk
Operational mode reported by IOS	static access	trunk
Appears in show interfaces trunk	No	Yes
Where the PC’s untagged frames land	Access VLAN	Native VLAN
VLANs the port can carry	Access VLAN plus one voice VLAN	Every VLAN on the allowed list
Allowed VLAN list applies	No	Yes

Building a telephony port as a trunk is a recognizable wrong answer. It works in the narrow sense that tagged voice frames pass, but the PC’s untagged traffic then lands in the trunk’s native VLAN rather than the intended data VLAN, and the port picks up the full trunk attack surface for no benefit. Because a voice port is not operationally trunking, an allowed VLAN list is neither required nor configurable on it.

Verification

SW1# show interfaces gigabitethernet 1/0/12 switchport
Name: Gi1/0/12
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 10 (DATA)
Trunking Native Mode VLAN: 1 (default)
Voice VLAN: 110 (VOICE)

Naming the interface before the switchport keyword is what narrows the output to one port. Access Mode VLAN and Voice VLAN are the two lines that answer where each traffic type goes. The Trunking Native Mode VLAN line reads 1 here and is inert, since native VLAN settings only take effect on a port that is operationally trunking. Operational Mode: static access confirms the port is not a trunk and therefore will not be listed by show interfaces trunk.

The condensed show vlan brief table is organized by VLAN and has no voice VLAN column at all, so it cannot answer a per-port voice question. show vlan id 7 describes VLAN 7 and has nothing to do with a port numbered Gi1/0/7.

How the 200-301 exam tests this

• Build the port. A phone with a PC behind it, data in one VLAN and voice in another. The correct answer is the access-mode configuration plus switchport voice vlan, and the distractors are trunk configurations or a swapped pair of VLAN IDs.
• Phone on the wrong subnet. The port configuration is flawless, the voice VLAN is active, the trunk allows it, and phones elsewhere work. The intended cause is that neither CDP nor LLDP-MED is running on that port.
• Interpret the output. Given a show interfaces switchport dump, decide what is tagged and what is not. Tagged voice from the phone, untagged data from the PC, and the port absent from trunk output.
• Requirement checklists. A multi-part scenario adds a naming requirement for the voice VLAN, which defeats the answer that relies on auto-creation, or adds “must never become a trunk”, which defeats the answer that omits switchport mode access.

The CDP dependency is the detail most candidates miss, and it is exactly the kind of gap CCNA practice questions find before the exam does.

Quick reference

• switchport voice vlan <id> is an interface subcommand on an access port; no other syntax creates a voice VLAN.
• The phone tags voice frames with the voice VLAN ID; the PC’s frames stay untagged and land in the access VLAN.
• Separation is by 802.1Q tag, never by MAC address or device type.
• The feature depends on CDP or LLDP-MED; without either, the phone lands in the data VLAN.
• The port remains operationally static access and never appears in show interfaces trunk.
• Auto-created voice VLANs get the default name VLAN0110; create and name the VLAN explicitly when the name matters.
• Verify with show interfaces <interface> switchport and read the Access Mode VLAN and Voice VLAN lines.