Security Mode And Normal Mode Of Voice Vlans - 3Com Baseline 2928 PWR Plus User Manual

If an IP phone sends tagged voice traffic and its access port is configured with 802.1X
authentication and guest VLAN, you must assign different VLAN IDs for the voice VLAN, the
default VLAN of the access port, and the 802.1X guest VLAN for the functions to operate normally.
If an IP phone sends untagged voice traffic, to deliver the voice VLAN function, you must configure
the default VLAN of the access port as the voice VLAN. In this case, 802.1X authentication function
cannot take effect.

Security Mode and Normal Mode of Voice VLANs

A voice VLAN-enabled port can operate in security mode or normal mode depending on its inbound
packet filtering mechanism.
Normal mode: In this mode, both voice packets and non-voice packets are allowed to pass through
a voice VLAN-enabled inbound port. When receiving a voice packet, the port forwards it without
checking its source MAC address against the OUI addresses configured for the device. If the
default VLAN of the port is the voice VLAN and the port works in manual VLAN assignment mode,
the port forwards all received untagged packets in the voice VLAN. In normal mode, the voice
VLANs are vulnerable to traffic attacks. Vicious users can forge a large amount of voice packets
and send them to voice VLAN-enabled ports to consume the voice VLAN bandwidth, affecting
normal voice communication.
Security mode: In this mode, only voice packets whose source MAC addresses comply with the
recognizable OUI addresses can pass through the voice VLAN-enabled inbound port, while all
other packets are dropped.
In a safe network, you can configure the voice VLANs to operate in normal mode, thus reducing the
consumption of system resources due to source MAC addresses checking.
It is recommended not to transmit both voice packets and non-voice packets in a voice VLAN. If you
have to, first ensure that the voice VLAN security mode is disabled.
Table 1-3 How a voice VLAN-enable port processes packets in security/normal mode
Voice VLAN working mode
Security mode
Packet type
Untagged packets
Packets carrying the voice
VLAN tag
Packets carrying other tags
1-3
Packet processing mode
If the source MAC address of a
packet matches an OUI
address configured for the
device, it is forwarded in the
voice VLAN; otherwise, it is
dropped.
Forwarded or dropped
depending on whether the port
allows packets of these VLANs
to pass through