HP Recommended voice VLAN configuration procedure

the PVID of the port is the voice VLAN and the port operates in manual VLAN assignment mode, the port forwards all received untagged packets in the voice VLAN. In normal mode, the voice VLANs are vulnerable to traffic attacks. Vicious users can forge a large amount of untagged packets and send them to voice VLAN-enabled ports to consume the voice VLAN bandwidth, affecting normal voice communication.

•Security mode—In this mode, only voice packets whose source MAC addresses comply with the recognizable OUI addresses can pass through the voice VLAN-enabled inbound port, but all other packets are dropped.

In a safe network, you can configure the voice VLANs to operate in normal mode, reducing the consumption of system resources due to source MAC addresses checking.

HP recommends not transmitting both voice packets and non-voice packets in a voice VLAN. If you have to, first make sure that the voice VLAN security mode is disabled.

Table 48 How a voice VLAN-enable port processes packets in security/normal mode

Voice VLAN operating mode Packet type Packet processing mode

Untagged packets

Packets carrying the voice VLAN tag

If the source MAC address of a packet matches an OUI address configured for the device, it is forwarded in the voice VLAN; otherwise, it is dropped.

Security mode		If the packet is a voice packet does
		not carry the voice VLAN tag or
		PVID tag, the packet is dropped.
	Packets carrying other tags	Otherwise, the packet is
		forwarded or dropped depending
		on whether the port allows packets
		of these VLANs to pass through.
	Untagged packets	The port does not check the source
		MAC addresses of inbound
	Packets carrying the voice VLAN tag	packets. All types of packets can
		be transmitted in the voice VLAN.
Normal mode
		Forwarded or dropped depending
	Packets carrying other tags	on whether the port allows packets
		of these VLANs to pass through

Recommended voice VLAN configuration procedure

Before configuring the voice VLAN, you must create the VLAN and configure the link type of each port to be assigned to the VLAN. Because VLAN 1 is the system-default VLAN, you do not need to create it; however, you cannot configure it as the voice VLAN. For information about port link types, see "Managing ports."

159