Networking

Voice VLAN Design: PoE Switch Configuration and Cisco IP Phone Provisioning

Articles · 2026 · Ioannis (John) Konstas

Separating voice and data traffic with IEEE 802.1Q VLANs, PoE switch configuration, TFTP/DHCP provisioning for Cisco IP phones, and the SCCP boot sequence.

Why a Separate Voice VLAN

Mixing voice and data traffic on the same VLAN causes QoS problems, broadcast interference, and security exposure.

VoIP traffic is latency-sensitive — a 150ms one-way delay is noticeable, and jitter above 30ms degrades call quality significantly. When IP phones share a data VLAN with computers and servers, their traffic competes for the same bandwidth and switch buffers. A dedicated voice VLAN solves three problems:

QoS isolation — voice packets can be marked with 802.1p priority and treated differently by the switch
Broadcast domain — phones do not see data VLAN broadcasts, reducing unnecessary CPU load on phone firmware
Security — phones on VLAN 10 cannot directly reach servers on VLAN 1 without routing through a firewall or router

Network Design

PBX Server (en0) ─────────── PoE Switch ───── Cisco IP Phone 1
  10.0.0.1 (data)                 │                (VLAN 10, ext 1001)
  10.10.0.1 (voice VLAN)          └────────── Cisco IP Phone 2
                                                     (VLAN 10, ext 1002)

VLAN	ID	Subnet	Use
Data	1 (native)	10.0.0.0/24	Computers, servers, management
Voice	10	10.10.0.0/24	Cisco IP phones (SCCP/SIP)

Cisco Switch Configuration (IOS)

A managed switch is required for separate voice and data VLANs. Unmanaged switches see section 3.

! Step 1 — Create the Voice VLAN
vlan 10
 name VOICE
exit

! Step 2 — Uplink port to PBX server (TRUNK — carries both VLANs)
interface GigabitEthernetX/X
 switchport mode trunk
 switchport trunk allowed vlan 1,10
 switchport trunk native vlan 1
 no shutdown

! Step 3 — Phone ports (ACCESS — voice VLAN tagged, data VLAN native)
interface range GigabitEthernetX/X - X
 switchport mode access
 switchport access vlan 1
 switchport voice vlan 10
 spanning-tree portfast          ! Eliminates 30-second STP delay on boot
 no shutdown
exit

! Step 4 — Enable PoE on phone ports
interface range GigabitEthernetX/X - X
 power inline auto
exit

The switchport voice vlan 10 command tells the switch to tag frames from a Cisco phone with VLAN 10 even though the port is in access mode. Cisco phones negotiate VLAN membership via CDP. The PC connected to the phone's passthrough port sees native VLAN 1.

Unmanaged PoE Switch (No VLANs)

If the switch is unmanaged, phones and computers share the same network. The setup is simpler but loses QoS isolation:

Skip VLAN 10 creation — all devices on the data subnet
DHCP serves the data subnet address range to all devices
Phones use the same gateway and TFTP server IP as computers
Acceptable for small lab environments; not recommended for production

DHCP Configuration for Phone Provisioning

Phones get their TFTP server address via DHCP Option 150 — the Cisco-specific TFTP option.

! Cisco IOS DHCP scope for Voice VLAN
ip dhcp pool VOICE-VLAN
 network 10.10.0.0 255.255.255.0
 default-router 10.10.0.1
 dns-server 8.8.8.8
 option 150 ip 10.10.0.1        ! TFTP server address (Option 150 = Cisco SCCP)
 lease 0 12                     ! 12-hour lease

ip dhcp excluded-address 10.10.0.1 10.10.0.20   ! Reserve gateway and servers

Option 150 is the Cisco proprietary TFTP option used by SCCP phones. SIP-mode Cisco phones use the standard Option 66 (TFTP server name) instead. Use the option that matches the firmware mode your phones are running.

TFTP Phone Provisioning

Cisco phones boot from TFTP — downloading firmware and configuration XML files.

Phone Boot Sequence

Phone powers on via PoE
Phone sends DHCP DISCOVER — receives IP + Option 150 (TFTP server)
Phone downloads XMLDefault.cnf.xml from TFTP — global defaults
Phone downloads SEP<MAC-ADDRESS>.cnf.xml from TFTP — per-phone config
Phone downloads SIP or SCCP firmware SBN files if version mismatch
Phone registers to the configured PBX/CME at the SIP/SCCP address
Extension shows green — phone ready

Per-Phone XML Configuration

<!-- SEPXXXXXXXXXXXX.cnf.xml (replace XX... with actual MAC) -->
<device>
  <devicePool>
    <dateTimeSetting>
      <dateTemplate>M/D/YA</dateTemplate>
      <timeZone>Eastern Standard/Daylight Time</timeZone>
    </dateTimeSetting>
  </devicePool>
  <sipProfile>
    <sipProxies>
      <backupProxy>10.10.0.1</backupProxy>
      <backupProxyPort>5060</backupProxyPort>
    </sipProxies>
    <phoneLabel>Front Desk</phoneLabel>
    <line1Name>1001</line1Name>
    <line1DisplayName>Front Desk</line1DisplayName>
    <line1AuthName>1001</line1AuthName>
    <line1Password><extension-password></line1Password>
  </sipProfile>
</device>

TFTP Server Setup (macOS/Linux)

# macOS — enable built-in TFTP daemon
sudo launchctl bootstrap system /System/Library/LaunchDaemons/tftp.plist
# Files served from /private/tftpboot/

# Linux (tftpd-hpa)
apt install tftpd-hpa
# Files served from /var/lib/tftpboot/

# Test TFTP is serving correctly
tftp 10.10.0.1
tftp> get XMLDefault.cnf.xml
# Should download successfully

TFTP has no authentication or encryption. Keep the TFTP server on the voice VLAN only, and restrict access via firewall rules. Never expose a TFTP server to the internet.

← All articles

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.