In which configuration mode is switchport voice vlan [vlan-id] used?

The switchport voice vlan [vlan-id] command is entered in Interface Config mode on Cisco IOS devices.

VLANInterface Config

switchport voice vlan [vlan-id]

Configures a switch port to carry voice traffic from an IP phone on a specific VLAN, separating voice and data traffic on the same physical port.

Definition: switchport voice vlan [vlan-id] is a Cisco IOS interface config command. Configures a switch port to carry voice traffic from an IP phone on a specific VLAN, separating voice and data traffic on the same physical port.

Overview

The `switchport voice vlan` command is a critical tool in Cisco IOS for configuring a switch port to carry voice traffic from an IP phone on a specific VLAN, effectively separating voice and data traffic on the same physical port. This command is used in access layer switches to support Voice over IP (VoIP) deployments, where an IP phone is connected to a switch port and the phone itself provides a pass-through connection for a PC. The concept behind this command is VLAN segmentation for quality of service (QoS) and security: voice traffic is placed in a dedicated voice VLAN (often VLAN 10, 20, etc.), while data traffic from the attached PC remains in the native data VLAN (usually VLAN 1 or a configured access VLAN).

This separation allows the network to apply different QoS policies (e.g., priority queuing for voice) and isolate voice traffic from data broadcasts. The command is typically used in conjunction with `switchport mode access` and `switchport access vlan` for the data VLAN. When an IP phone is connected, it uses Cisco Discovery Protocol (CDP) or LLDP to learn the voice VLAN ID and automatically tags its voice frames with that VLAN ID, while the PC traffic remains untagged in the access VLAN.

The switch port must be configured as an access port (not trunk) for this to work. The command is essential in enterprise networks where IP phones are deployed, as it ensures voice quality by preventing data congestion from affecting voice packets. Alternatives include using a trunk port with native VLAN for data and allowing voice VLAN, but the `switchport voice vlan` command is simpler and more common.

In the broader configuration workflow, this command is part of the initial switch port configuration for VoIP readiness, often followed by QoS settings like `mls qos trust cos` or `auto qos voip cisco-phone`. Important IOS behavior: the command is available in interface configuration mode, requires at least privilege level 15 (enable mode), and its effect is immediately written to the running configuration. The switch port must be in access mode; if the port is in trunk mode, the command is rejected.

Also, the voice VLAN must exist in the VLAN database; otherwise, the command fails. The command does not affect the port's operational state until an IP phone is detected via CDP/LLDP. Common mistakes include configuring the voice VLAN on a trunk port or forgetting to create the VLAN first.

This command is a cornerstone of Cisco's VoIP architecture and is tested extensively in CCNA and CCNP exams.

Syntax·Interface Config

switchport voice vlan [vlan-id]

When to Use This Command

Deploying Cisco IP phones in an office environment where PCs are daisy-chained through the phone's pass-through port.
Segmenting voice traffic into a dedicated VLAN for QoS and security purposes.
Enabling a switch port to automatically use CDP to assign a voice VLAN to a connected IP phone.
Integrating with a VoIP system that requires a specific VLAN for voice traffic.

Parameters

Parameter	Syntax	Required	Description
vlan-id	<1-4094>	Required	Specifies the VLAN ID for voice traffic. Valid values are from 1 to 4094, but VLAN 1 is typically not used for voice. Common practice is to use VLANs like 10, 20, etc. The VLAN must exist in the switch's VLAN database; otherwise, the command will be rejected. A common mistake is using a VLAN that is not created or using a reserved VLAN (e.g., 1002-1005).

Command Examples

Basic voice VLAN assignment

switchport voice vlan 10

This command configures the interface to use VLAN 10 for voice traffic. No output is shown if successful; the command is applied immediately.

Verifying voice VLAN configuration

show interfaces gigabitethernet 0/1 switchport

Name: Gi0/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: 10
Administrative Private VLAN Host Association: none
Administrative Private VLAN Mapping: none
Operational Private VLAN: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL

Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled
Appliance trust: none

The 'Voice VLAN: 10' line confirms that voice traffic on this port will be tagged with VLAN 10. Other fields show the port is in trunk mode, with native VLAN 1. The 'Access Mode VLAN' is the data VLAN. This output is useful to verify that the voice VLAN is set correctly.

Understanding the Output

The 'show interfaces switchport' command displays the voice VLAN configuration under the 'Voice VLAN' field. A value of '10' indicates that voice traffic is tagged with VLAN 10. If the field shows 'none' or is missing, the voice VLAN is not configured.

The 'Access Mode VLAN' shows the data VLAN for untagged traffic. In a typical setup, the IP phone uses CDP to learn the voice VLAN and tags its traffic accordingly, while the PC traffic remains untagged on the access VLAN. Ensure the voice VLAN exists in the VLAN database and is allowed on trunk links if the port is a trunk.

A common issue is forgetting to create the VLAN first, which results in the port being error-disabled or the configuration being rejected.

Configuration Scenarios

Basic Voice VLAN Configuration for an IP Phone with PC Pass-Through

A small office has a Cisco IP phone connected to a switch port, and a PC is connected to the phone's pass-through port. The goal is to separate voice traffic on VLAN 10 and data traffic on VLAN 20.

Topology

PC --- IP Phone --- Gi0/1 (Switch) --- Rest of Network

Steps

1.Step 1: Enter global configuration mode: Switch> enable, Switch# configure terminal
2.Step 2: Create VLANs 10 and 20: Switch(config)# vlan 10, Switch(config-vlan)# name Voice, Switch(config-vlan)# exit, Switch(config)# vlan 20, Switch(config-vlan)# name Data, Switch(config-vlan)# exit
3.Step 3: Enter interface configuration mode for Gi0/1: Switch(config)# interface gigabitEthernet 0/1
4.Step 4: Set the port to access mode: Switch(config-if)# switchport mode access
5.Step 5: Assign the data VLAN: Switch(config-if)# switchport access vlan 20
6.Step 6: Configure the voice VLAN: Switch(config-if)# switchport voice vlan 10
7.Step 7: (Optional) Enable QoS trust: Switch(config-if)# mls qos trust cos
8.Step 8: Exit and save: Switch(config-if)# end, Switch# copy running-config startup-config

Configuration

! Full IOS config block
Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name Voice
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name Data
Switch(config-vlan)# exit
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 20
Switch(config-if)# switchport voice vlan 10
Switch(config-if)# mls qos trust cos
Switch(config-if)# end
Switch# copy running-config startup-config

Verify: Use `show interfaces gigabitEthernet 0/1 switchport` to verify. Expected output includes: 'Administrative Mode: static access', 'Access Mode VLAN: 20 (Data)', 'Voice VLAN: 10 (Voice)'. Also, `show vlan brief` should show VLANs 10 and 20 with assigned ports.

Watch out: Forgetting to create the voice VLAN before applying the command will result in '% Voice VLAN 10 is not configured' error. Always create the VLAN first.

Voice VLAN on a Trunk Port (Alternative Method)

A network engineer wants to carry voice traffic on a trunk link between two switches, but still separate voice and data. This scenario shows how to configure a trunk port to carry voice VLAN explicitly.

Topology

Switch1(Gi0/1)---Trunk---(Gi0/1)Switch2

Steps

1.Step 1: On Switch1, enter interface configuration for Gi0/1: Switch1(config)# interface gigabitEthernet 0/1
2.Step 2: Configure trunk mode: Switch1(config-if)# switchport mode trunk
3.Step 3: Allow voice VLAN (e.g., 10) on trunk: Switch1(config-if)# switchport trunk allowed vlan add 10
4.Step 4: (Optional) Set native VLAN for data: Switch1(config-if)# switchport trunk native vlan 20
5.Step 5: Repeat similar configuration on Switch2.
6.Step 6: Save configuration.

Configuration

! On Switch1
Switch1# configure terminal
Switch1(config)# interface gigabitEthernet 0/1
Switch1(config-if)# switchport mode trunk
Switch1(config-if)# switchport trunk allowed vlan add 10
Switch1(config-if)# switchport trunk native vlan 20
Switch1(config-if)# end
Switch1# copy running-config startup-config

Verify: Use `show interfaces trunk` to verify trunk status and allowed VLANs. Expected output shows trunking mode, native VLAN 20, and VLANs allowed including 10.

Watch out: On a trunk port, the `switchport voice vlan` command is not used; instead, you manually add the voice VLAN to the allowed list. A common mistake is trying to use `switchport voice vlan` on a trunk port, which is invalid.

Troubleshooting with This Command

When troubleshooting voice VLAN issues, the `show interfaces switchport` command is the primary tool. Healthy output for an access port with voice VLAN configured should display 'Voice VLAN: <vlan-id>' and 'Access Mode VLAN: <data-vlan>'. If the voice VLAN is missing or shows 'none', the IP phone may not be receiving the correct VLAN information.

Another key indicator is the operational mode: if the port is not in access mode, the voice VLAN configuration is ignored. Use `show interfaces status` to check if the port is up/up and if the phone is detected (CDP/LLDP). Common symptoms include: IP phone not getting an IP address (DHCP failure), phone showing 'Configuring VLAN' indefinitely, or one-way audio.

To diagnose, first verify the voice VLAN exists with `show vlan id <vlan-id>`. Then check CDP/LLDP neighbors with `show cdp neighbors` or `show lldp neighbors` to ensure the switch sees the phone. If the phone is not detected, check cabling and port security.

If the phone is detected but not using the voice VLAN, verify that the phone is configured to trust the switch (auto-negotiation via CDP). Use `debug sw-vlan cdp` or `debug lldp packets` to see VLAN information exchange. Another common issue is QoS: if voice packets are being dropped, check `show mls qos interface <interface>` to see if trust is set correctly.

For trunk ports, ensure the voice VLAN is allowed on the trunk. Correlate with `show interfaces trunk` to see allowed VLANs. If the phone is on a different switch, check the trunk between switches for VLAN pruning.

Also, verify that the voice VLAN is not the same as the native VLAN, as this can cause confusion. Step-by-step diagnostic flow: 1) Check physical connectivity and port status. 2) Verify VLAN creation. 3) Check switchport configuration. 4) Verify CDP/LLDP neighbor. 5) Check DHCP server scope for voice VLAN. 6) Check QoS policies. 7) Use packet captures if necessary. The `show running-config interface <interface>` command is also useful to see the exact configuration applied.

CCNA Exam Tips

CCNA exam tip: The voice VLAN command is only available on switch ports configured as access or trunk; it is not valid on routed ports.

CCNA exam tip: The IP phone uses CDP to discover the voice VLAN; if CDP is disabled, the phone may not tag traffic correctly.

CCNA exam tip: The voice VLAN can be configured as a VLAN ID or as 'dot1p' to use 802.1p priority tagging on the native VLAN.

CCNA exam tip: On a trunk port, the voice VLAN is automatically added to the allowed VLAN list; you do not need to manually add it.

Common Mistakes

Mistake 1: Forgetting to create the voice VLAN before applying the command, causing the port to go into error-disabled state.

Mistake 2: Applying the command on a port that is already configured as a trunk without verifying that the voice VLAN is allowed on the trunk.

Mistake 3: Confusing the voice VLAN with the access VLAN; the access VLAN is for data, the voice VLAN is for voice traffic.

switchport voice vlan [vlan-id] vs switchport access vlan [vlan-id]

Both switchport voice vlan and switchport access vlan are interface configuration commands that assign VLANs to access ports, but they serve different traffic types. They are commonly confused because they can be used together on the same port to separate voice and data traffic, leading to misunderstandings about which command controls which traffic.

Aspect	switchport voice vlan [vlan-id]	switchport access vlan [vlan-id]
Traffic affected	Voice traffic (tagged or untagged per phone config)	Data traffic (always untagged)
VLAN tagging	Accepts tagged voice frames (typically 802.1Q)	Port is in VLAN for untagged frames
Interaction	Used alongside switchport access vlan for data VLAN	Sets the native (data) VLAN; voice VLAN is additional
Configuration requirement	Requires voice VLAN feature (default enabled)	No special feature required
Typical scenario	IP phone with PC behind (separate voice/data VLANs)	Single end device in a specific VLAN
Effect on port	Enables CoS trust and voice VLAN	Puts port in VLAN for all untagged traffic

Use switchport voice vlan [vlan-id] when connecting an IP phone to a switch port and you need to isolate voice traffic in a dedicated VLAN while data traffic remains in the access VLAN.

Use switchport access vlan [vlan-id] when assigning a single end device (like a PC or printer) to a specific VLAN for untagged data traffic.

Platform Notes

In IOS-XE (e.g., Catalyst 3650/3850/9300), the `switchport voice vlan` command syntax is identical to classic IOS. However, the verification output in `show interfaces switchport` may include additional fields like 'Voice VLAN: 10 (Inactive)' if the VLAN is not active. In NX-OS (e.g., Nexus 9000), the equivalent command is `switchport voice vlan <vlan-id>` as well, but the interface must be in access mode; NX-OS also supports `switchport voice vlan dot1p` for marking.

On ASA firewalls, this command does not exist; voice VLAN configuration is done on switches. In IOS-XR, the command is not available; voice VLAN is typically handled via Ethernet flow points or bridge domains. For IOS versions 12.x and 15.x, the command behaves the same, but in 12.x, the switchport must be in access mode explicitly; in 15.x, the command automatically sets the port to access mode if not already.

In IOS 16.x (IOS-XE), the behavior is consistent with 15.x. Some older IOS versions (e.g., 12.2) require the `switchport voice vlan` command to be entered after `switchport mode access`, otherwise it may be rejected. On Catalyst 2960 and 3560 series, the command is fully supported.

On Catalyst 4500/6500 with Supervisor engines, the command works but may require additional VLAN configuration. Always check the specific platform documentation for any quirks.

Related Commands

show interfaces switchport

Displays the administrative and operational status of a switch port, including VLAN membership, trunking mode, and access VLAN, used to verify VLAN configuration and port security settings.

switchport access vlan [vlan-id]

Assigns a specific VLAN to an access port, placing the port in that VLAN for untagged traffic.

switchport mode access

Statically configures a switch port as an access port, disabling all DTP negotiation so the port permanently carries traffic for a single VLAN and can never negotiate to trunk mode.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions