Security Mode And Normal Mode Of Voice Vlans - HP FlexNetwork NJ5000 User Manual

Port link
type
Hybrid
•
IP phones send untagged voice traffic
When IP phones send untagged voice traffic, you can only configure the voice traffic receiving
ports on the device to operate in manual voice VLAN assignment mode.
Table 53 Required configurations on ports of different link types for them to support
tagged voice traffic
Port link
type
Access
Trunk
Hybrid
NOTE:
• If an IP phone sends tagged voice traffic and its access port is configured with 802.1X
authentication and guest VLAN, you must assign different VLAN IDs for the voice VLAN, the
PVID of the access port, and the 802.1X guest VLAN for the functions to operate normally.
• If an IP phone sends untagged voice traffic, to deliver the voice VLAN function, you must
configure the PVID of the access port as the voice VLAN. As a result, 802.1X authentication does
not take effect.

Security mode and normal mode of voice VLANs

Depending on their inbound packet filtering mechanisms, voice VLAN-enabled ports operate in one
of the following modes:
•
Normal mode—In this mode, both voice packets and non-voice packets are allowed to pass
through a voice VLAN-enabled inbound port. When receiving a voice packet, the port forwards
it without checking its source MAC address against the OUI addresses configured for the
device. If the PVID of the port is the voice VLAN and the port operates in manual VLAN
assignment mode, the port forwards all received untagged packets in the voice VLAN. In
normal mode, the voice VLANs are vulnerable to traffic attacks. Vicious users can forge a large
amount of untagged packets and send them to voice VLAN-enabled ports to consume the voice
VLAN bandwidth, affecting normal voice communication.
•
Security mode—In this mode, only voice packets whose source MAC addresses comply with
the recognizable OUI addresses can pass through the voice VLAN-enabled inbound port, but
all other packets are dropped.
Voice VLAN assignment
mode supported for tagged
voice traffic
Automatic and manual
Voice VLAN assignment mode
supported for untagged voice
traffic
Manual
Manual
Manual
129
Configuration requirements
In automatic mode, the PVID of the port cannot
be the voice VLAN.
In manual mode, configure the port to permit
packets of the voice VLAN to pass through
tagged.
Configuration requirements
Configure the PVID of the port as the voice
VLAN.
Configure the PVID of the port as the voice
VLAN and assign the port to the voice VLAN.
Configure the PVID of the port as the voice
VLAN and configure the port to permit
packets of the voice VLAN to pass through
untagged.