A company's campus network typically is made up of at least two "hierarchical layers" of LAN switching devices. Within these layers, Virtual Local Area Networks (VLANs) are used to manage traffic queues.
A VLAN is used for logically segmented traffic or a broadcast domain over a switched network. For example, all workstations and servers used by a particular division within an organization can operate over the same VLAN, regardless of their physical locations or connections within the campus. VLANs meet the scalability, security, and management requirements of a network infrastructure.
Today's access switches are required to support IP telephony alongside data traffic in the LAN. The switches also are able to support multiple VLANs on the access port connected to an IP phone. However, the introduction of IP phones into a data switched campus presents some challenges. The current IP addressing scheme could be saturated with IP addresses for data endpoint, thus limiting the IP address space available for IP phones. In addition, the combination of voice and data traffic over the same VLAN could reduce the necessary quality for VoIP traffic, especially in the event of broadcast storms.
These challenges can be addressed by creating a separate VLAN and isolating the voice traffic onto this VLAN. The switch port would have an auxiliary VLAN carrying voice traffic to and from the IP phone, and the port would have data traffic traversing the native VLAN carrying data traffic to and from the PC or data endpoint. The isolation of the voice traffic onto an auxiliary VLAN also permits a large quantity of phones to be implemented into the network infrastructure by essentially creating a new subnet and a new set of IP addresses.
As mentioned previously, voice and data on the same broadcast domain can deteriorate sound quality. When the transmission of data packets become bursty, the inherent delay and jitter within the network adversely affects voice quality. However, the separation of voice traffic on an auxiliary VLAN increases its quality. For example, Cisco switches utilize Class of Service parameters to prioritize voice traffic based on 802.1Q VLAN tagging. Once voice traffic is prioritized, it can be then expedited using a higher priority queue. In addition, the switch can be used to trust or adjust the 802.1Q priority naturally assigned by the phone.
Separate VLANs over a converged infrastructure also augment the security of the network. Cisco's CallManager can be configured to deny the forwarding of auxiliary voice packets to the PC. Conversely, the PC is able to use VLAN tagging without needing permission into the voice VLAN.
Finally, the implementation of an auxiliary/native VLAN solution eases the day-to-day operation or troubleshooting of the converged infrastructure. Due to the auxiliary voice VLAN and its IP address range's segmentation from the data infrastructure, the identification of problematic source components is greatly enhanced. Access-lists are additionally easier to design and configure when separate VLANs exist.
While it is not mandated to implement auxiliary and native VLANs for a converged design over a campus environment, the above mentioned benefits appear to warrant its recommendation.
Richard Parsons (CCIE#5719) is a Manager of Professional Services for Callisma Inc., a wholly owned subsidiary of SBC. He has built a solid foundation in networking concepts, advanced troubleshooting, and monitoring in areas such as optical, ATM, VoIP, routed, routing, and storage infrastructures. Rich resides in Atlanta GA, and is a graduate of Clemson University. His background includes senior and principal consulting positions at International Network Services, Lucent, and Callisma.
