FN-GM Posted June 7, 2017 Posted June 7, 2017 If they have no IP address they are Layer 2 VLANs, not routed. Is VLAN 3 the same VLAN the rest of your network is in? If so you won't need to touch that interface. Do these IP phones need access to the internet? If so you may need to make changes on your firewall, ISP router or whatever depending on the topology.
FN-GM Posted June 7, 2017 Posted June 7, 2017 Depending on the answer to the questions above, I have some commands and instructions
fiza Posted June 7, 2017 Author Posted June 7, 2017 If I am on the CLI of the switch should I be able to ping a device which I know is on VLAN 2? At the moment I can't.
fiza Posted June 7, 2017 Author Posted June 7, 2017 If they have no IP address they are Layer 2 VLANs, not routed. Is VLAN 3 the same VLAN the rest of your network is in? If so you won't need to touch that interface. Do these IP phones need access to the internet? If so you may need to make changes on your firewall, ISP router or whatever depending on the topology. VLAN 3 is where all the rest of the devices are except for the door access system which is on VLAN 2. The IP phones need to connect to the internet as they need to connect to Horizon. The ISP have already got details of the network associated with VLAN 2 and they say the firewall/router is configured for this.
FN-GM Posted June 7, 2017 Posted June 7, 2017 Just to confirm, is your ISP Router/Firewall in VLAN 3?
mavhc Posted June 7, 2017 Posted June 7, 2017 VLAN means "a fake separate LAN", so by default they can't talk to each other. IP (192.168.0.1 etc) is Layer 3, Ethernet (MAC addresses etc) is Layer 2. A Layer 2 switch can't let VLANs talk to each other, a Router or a Layer 3 switch can, they know about IP stuff. You have wires connecting your switches, to make your LAN, if you have multiple VLANs you need to tell the switch which VLANs can travel down which wires. If you want all VLANs on a wire, because it connects switches together, you configure that port to be a Trunk, which just means everything is send down the wire. So you need the same VLANs configured on each switch, and the links between the switches set as Trunk. So far you'd have an internal phone network working, but you also need to get onto the internet for external calls (I assume, we have voip phones but only internally, so our VOIP controller is on the phone vlan, and it just connects to the phone lines) So you'd need to configure your router (or a layer 3 switch) to take traffic from the voip vlan to "no vlan" so you can phone the outside world. Or have 2 cables on your voip controller, incoming on vlan voice, and outgoing on standard vlan to the router. You shouldn't be able to ping another vlan, unless rules have been set up to allow that, seems that assigning a layer 3 switch vlan an ip means that by default it will route between vlans, you can then set firewall rules on the switch to alter that behaviour if you want.
fiza Posted June 7, 2017 Author Posted June 7, 2017 Just to confirm, is your ISP Router/Firewall in VLAN 3? The gateway address used for the router is in VLAN3.
FN-GM Posted June 7, 2017 Posted June 7, 2017 Just to note, as your ISP Firewall / Router is in vlan 3 you still may have issues as the voice traffic is entering a vlan with high amount of broadcast. I put my Firewall in its own VLAN to avoid this You will need to 1. Enable routing en conf t IP routing 2. Set the gateway of last resort. This is for internet traffic to get out. For the IP address use your ISP router, Smoothwall or whatever. Change 10.10.10.10 to this IP. en conf t ip route 0.0.0.0 0.0.0.0 10.10.10.10 3. You will need to create a VLAN for the Phone, in this instance vlan 10, you can change this. en vlan 10 4. You will need to give the new VLAN an IP address. If you are using DHCP for the phones use the IP Helper command en conf t ip address ip helper-address 5. Setup DHCP or static addresses on the phone. Use the VLAN IP address on step 4 and the default gateway of the devices
FN-GM Posted June 7, 2017 Posted June 7, 2017 Just to note for ip helper-address the IP you enter is the IP for the DHCP server. The DHCP server will need the default gateway set to the VLAN 3 IP address (also the management IP address of the core switch)
fiza Posted June 7, 2017 Author Posted June 7, 2017 The switches the school have are Cisco SG300 and SG500s. The core switch is the SG500. Are either of these Layer 3?
FN-GM Posted June 7, 2017 Posted June 7, 2017 Don't think so. on your IPS firewall do you have a dedicated port for VLAN 2?
fiza Posted June 7, 2017 Author Posted June 7, 2017 Just to note for ip helper-address the IP you enter is the IP for the DHCP server. The DHCP server will need the default gateway set to the VLAN 3 IP address (also the management IP address of the core switch) I know that there is a server supplying DHCP addresses in VLAN2. This is separate from the DHCP server providing addresses on VLAN3. Apologies for all the noob questions but I know next to nothing about VLANs and the network was not set up by me so I don't know that much about it other than the limited documentation left behind. - - - Updated - - - Don't think so. on your IPS firewall do you have a dedicated port for VLAN 2? They have said they will create this for me.
FN-GM Posted June 7, 2017 Posted June 7, 2017 "They have said they will create this for me." In that case ignore anything I have said. When they do that all you need to do it. 1.You will need to create a VLAN for the Phone on each switch, in this instance vlan 2, you can change this. en vlan 2 2. Set the uplink between switches to trunk links 3. Setup your ports en conf t Int Gi0/1 Switchport Voice VLAN 2 4. Plugin a port that is in VLAN 2 (nothing else) into the ISP firewall port setup for VLAN 2 Before doing that you try plugging the phone directly into the ISP port for VLAN and power the phone using a POE injector. If they have set it up right it should work. 1
mavhc Posted June 7, 2017 Posted June 7, 2017 Cisco 300 Series Managed Switches Data Sheet - Cisco says they are layer 3 1
fiza Posted June 7, 2017 Author Posted June 7, 2017 Cisco 300 Series Managed Switches Data Sheet - Cisco says they are layer 3 i have just logged into the switches GUI and it says they are all running : System Operational Mode : L2 mode.
mavhc Posted June 7, 2017 Posted June 7, 2017 Sounds like your first task is to completely document how it's working now, and let us know that, switch models, modes of operation, vlan settings, what vlans are used, router settings as you can guess them etc 1
fiza Posted June 7, 2017 Author Posted June 7, 2017 Sounds like your first task is to completely document how it's working now, and let us know that, switch models, modes of operation, vlan settings, what vlans are used, router settings as you can guess them etc Starting that process now.
fiza Posted June 7, 2017 Author Posted June 7, 2017 "They have said they will create this for me." In that case ignore anything I have said. When they do that all you need to do it. 1.You will need to create a VLAN for the Phone on each switch, in this instance vlan 2, you can change this. en vlan 2 2. Set the uplink between switches to trunk links 3. Setup your ports en conf t Int Gi0/1 Switchport Voice VLAN 2 4. Plugin a port that is in VLAN 2 (nothing else) into the ISP firewall port setup for VLAN 2 Before doing that you try plugging the phone directly into the ISP port for VLAN and power the phone using a POE injector. If they have set it up right it should work. Will do thanks. Just waiting for the ISP to give me a date/time when they can do this.
fiza Posted June 12, 2017 Author Posted June 12, 2017 (edited) Thanks everyone for your help. I managed to get 2 phones onto VLAN 2 which is set up as the Voice VLAN. I had to set a DHCP scope option 128 to correspond to the VLAN the phones were to use. Once I did this both phones connected no problems. I have left it with the school now to tell me if either of those 2 phones have any dropouts over the course of the week. If no dropouts occur then I will move all phones onto VLAN 2. Edit : Just to add that I did tag VLAN 2 and Untag VLAN 3 on each port that the phones were connected to. The phones and PCs connect correctly and the phones are picking up DHCP addresses from the DHCP server in VLAN 2. Edited June 12, 2017 by fiza
fiza Posted June 12, 2017 Author Posted June 12, 2017 Are the PC's on these test phones in VLAN 2? No the computers are in vlan 3 where they were originally and where the phones were originally.
fiza Posted June 19, 2017 Author Posted June 19, 2017 So I moved 3 phones to a separate voice VLAN utilising SmartPort but those 3 users still say they are experiencing dropouts during conversations both with external calls and internal. I am not sure what to do now. Any ideas?
mavhc Posted June 19, 2017 Posted June 19, 2017 Is everything on one switch? Can you see any usage graphs for that switch?
colly72 Posted June 19, 2017 Posted June 19, 2017 A shot in the dark but we have Intrusion Prevention turned on, on our Sophos firewall and we had to create exceptions so that it didn't interfere with our IP Office system
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now