Interoperation Between Switches and IP Phones Through MAC Address-based VLAN Assignment
Overview
If an IP phone does not support LLDP or DHCP, a switch cannot allocate a voice VLAN ID to it. You can configure MAC address-based VLAN assignment on the switch. Then the switch identifies voice packets based on the MAC address of the IP phone and increases the priority of voice packets.
For applicable IP phones, see List of IP Phone Models That Can Be Connected to Switches.
Configuration Notes
- This example applies to all versions of all S series switches.
If the IP phone cannot go online, rectify the fault according to Appendix 1: Common Causes for IP Phones' Login Failures and Workaround.
Networking Requirements
- The priority of voice packets needs to be increased to ensure communication quality.
- Voice packets are transmitted in VLAN 100.
- IP addresses of IP phones are dynamically allocated by the DHCP server, and are on a different network segment from that of the DHCP server.
- IP phones can go online without authentication because the network environment is secure.
Configuration Roadmap
To implement interoperation between switches and IP phones through MAC address-based VLAN assignment, you need to apply for IP addresses for IP phones, bring IP phones online without authentication, and conduct communication normally. Figure 1-13 shows the process for interoperation between switches and IP phones through MAC address-based VLAN assignment. In this mode, the authentication server does not need to be configured.
The operations of applying for IP addresses and enabling IP phones to go online without authentication can be performed simultaneously.
- Configure MAC address-based VLANs, assign VLANs to IP phones, and increase the priority.
- Configure the DHCP relay function and DHCP server to allocate IP addresses to IP phones.
- Configure IP phones to go online without authentication.
Data Plan
Item |
Value |
---|---|
Voice VLAN |
VLAN 100 |
MAC address |
001b-d4c7-0001 0021-a08f-0002 |
Address segment |
10.20.20.1/24 |
Authentication mode |
Non-authentication |
Item |
Value |
---|---|
VLAN and IP address used by SwitchA to communicate with SwitchB |
VLAN 200; 10.10.20.1/24 |
VLAN and IP address used by SwitchB to communicate with SwitchA |
VLAN 200; 10.10.20.2/24 |
IP address of SwitchA |
192.168.100.200 |
IP address of the RADIUS authentication and accounting server |
192.168.100.182 |
Port number of the RADIUS authentication server |
1812 |
Port number of the RADIUS accounting server |
1813 |
RADIUS shared key |
Huawei2012 |
Procedure
- Add an interface on SwitchA to a VLAN.
# Create voice VLAN 100
<HUAWEI> system-view [HUAWEI] sysname SwitchA [SwitchA] vlan batch 100
# Add an interface to VLAN 100 in untagged mode.
[SwitchA] interface gigabitethernet 1/0/1 [SwitchA-GigabitEthernet1/0/1] port link-type hybrid //In V200R005C00 and later versions, the default link type of an interface is not hybrid, and needs to be manually configured. [SwitchA-GigabitEthernet1/0/1] port hybrid untagged vlan 100 //Packets sent by IP phones do not carry tags, so the interface must be join VLAN 100 in untagged mode. [SwitchA-GigabitEthernet1/0/1] quit [SwitchA] interface gigabitethernet 1/0/2 [SwitchA-GigabitEthernet1/0/2] port link-type hybrid [SwitchA-GigabitEthernet1/0/2] port hybrid untagged vlan 100 [SwitchA-GigabitEthernet1/0/2] quit
- Enable MAC address-based VLAN assignment.
[SwitchA] vlan 100 [SwitchA-vlan100] mac-vlan mac-address 001b-d4c7-1fa9 ffff-ffff-0000 priority 6 //The MAC address corresponds to the MAC address of the IP phone. The mask can be used. This command adds VLAN 100 to untagged packets with the source MAC address starting from 001b-d4c7 and changes the 802.1p priority to 6. [SwitchA-vlan100] mac-vlan mac-address 0021-a08f-0000 ffff-ffff-0000 priority 6 [SwitchA-vlan100] quit [SwitchA] interface gigabitethernet 1/0/1 [SwitchA-GigabitEthernet1/0/1] mac-vlan enable //Enable MAC address-based VLAN assignment on an interface. When the interface receives untagged packets, the packets are processed based on the binding between MAC addresses and VLANs. [SwitchA-GigabitEthernet1/0/1] quit [SwitchA] interface gigabitethernet 1/0/2 [SwitchA-GigabitEthernet1/0/2] mac-vlan enable [SwitchA-GigabitEthernet1/0/2] quit
- Configure the DHCP relay function and DHCP server.
- Configure an AAA domain and configure voice terminals can
go online without authentication.
- Verify the configuration.
- You can see that the IP phone can correctly obtain the IP address through the menu of the IP phone.
- The display mac-address vlan 100 command output
on SwitchA displays connection information about IP phones.
[SwitchA] display mac-address vlan 100 ------------------------------------------------------------------------------- MAC Address VLAN/VSI Learned-From Type ------------------------------------------------------------------------------- 001b-d4c7-1fa9 100/- GE1/0/1 dynamic 0021-a08f-2fa8 100/- GE1/0/2 dynamic -------------------------------------------------------------------------------
Configuration Files
-
SwitchA configuration file (V200R007C00 and earlier versions, and V200R008C00)
# sysname SwitchA # vlan batch 100 200 # lldp enable # dhcp enable # vlan 100 mac-vlan mac-address 001b-d4c7-1fa9 ffff-ffff-0000 priority 6 mac-vlan mac-address 0021-a08f-0000 ffff-ffff-0000 priority 6 # authentication device-type voice authorize service-scheme ipphone # radius-server template ipphone radius-server shared-key cipher %^%#e33GK([auIJQ+54M/i7>u5!/M8*A%0]~a@FQ,41K%^%# radius-server authentication 192.168.100.182 1812 weight 80 radius-server accounting 192.168.100.182 1813 weight 80 # aaa authentication-scheme radius authentication-mode radius service-scheme ipphone domain default authentication-scheme radius radius-server ipphone # interface Vlanif100 ip address 10.20.20.1 255.255.255.0 dhcp select relay dhcp relay server-ip 10.10.20.2 # interface Vlanif200 ip address 10.10.20.1 255.255.255.0 # interface GigabitEthernet1/0/1 port link-type hybrid port hybrid untagged vlan 100 mac-vlan enable # interface GigabitEthernet1/0/2 port link-type hybrid port hybrid untagged vlan 100 mac-vlan enable # interface GigabitEthernet1/0/3 port link-type access port default vlan 200 # ip route-static 0.0.0.0 0.0.0.0 10.10.20.2 # return
-
SwitchA configuration file (V200R009C00 and later versions)
# sysname SwitchA # vlan batch 100 200 # authentication-profile name ipphone authentication device-type voice authorize service-scheme ipphone # vlan 100 mac-vlan mac-address 001b-d4c7-1fa9 ffff-ffff-0000 priority 6 mac-vlan mac-address 0021-a08f-0000 ffff-ffff-0000 priority 6 # lldp enable # dhcp enable # radius-server template ipphone radius-server shared-key cipher %^%#e33GK([auIJQ+54M/i7>u5!/M8*A%0]~a@FQ,41K%^%# radius-server authentication 192.168.100.182 1812 weight 80 radius-server accounting 192.168.100.182 1813 weight 80 # aaa authentication-scheme radius authentication-mode radius service-scheme ipphone domain default authentication-scheme radius service-scheme ipphone radius-server ipphone # interface Vlanif100 ip address 10.20.20.1 255.255.255.0 dhcp select relay dhcp relay server-ip 10.10.20.2 # interface Vlanif200 ip address 10.10.20.1 255.255.255.0 # interface GigabitEthernet1/0/1 port link-type hybrid port hybrid untagged vlan 100 mac-vlan enable # interface GigabitEthernet1/0/2 port link-type hybrid port hybrid untagged vlan 100 mac-vlan enable # interface GigabitEthernet1/0/3 port link-type access port default vlan 200 # ip route-static 0.0.0.0 0.0.0.0 10.10.20.2 # return
- SwitchB configuration file
# sysname SwitchB # vlan batch 200 # dhcp enable # ip pool ip-phone gateway-list 10.20.20.1 network 10.20.20.0 mask 255.255.255.0 # interface Vlanif200 ip address 10.10.20.2 255.255.255.0 dhcp select global # interface GigabitEthernet1/0/3 port link-type access port default vlan 200 # ip route-static 10.20.20.0 255.255.255.0 10.10.20.1 # return