Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

VoIP on EX Series Switches

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones. When you use VoIP, you can connect IP telephones to the switch and configure IEEE 802.1X authentication for 802.1X-compatible IP telephones. For more information, read this topic.

Understanding 802.1X and VoIP on EX Series Switches

When you use VoIP, you can connect IP telephones to the switch and configure IEEE 802.1X authentication for 802.1X-compatible IP telephones. The 802.1X authentication provides network edge security, protecting Ethernet LANs from unauthorized user access.

VoIP is a protocol used for the transmission of voice through packet-switched networks. VoIP transmits voice calls by using a network connection instead of an analog phone line.

When VoIP is used with 802.1X, the RADIUS server authenticates the phone, and Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) provides the class-of-service (CoS) parameters to the phone.

You can configure 802.1X authentication to work with VoIP in multiple supplicant or single supplicant mode. In multiple supplicant mode, the 802.1X process allows multiple supplicants to connect to the interface. Each supplicant is authenticated individually. For an example of a VoIP multiple supplicant topology, see Figure 1.

Figure 1: VoIP Multiple Supplicant TopologyVoIP Multiple Supplicant Topology

If an 802.1X-compatible IP telephone does not have an 802.1X host but has another 802.1X-compatible device connected to its data port, you can connect the phone to an interface in single supplicant mode. In single supplicant mode, the 802.1X process authenticates only the first supplicant. All other supplicants who connect later to the interface are allowed full access without any further authentication. They effectively “piggyback” on the first supplicant’s authentication. For an example of a VoIP single supplicant topology, see Figure 2 .

Figure 2: VoIP Single Supplicant TopologyVoIP Single Supplicant Topology

If an IP telephone does not support 802.1X, you can configure VoIP to bypass 802.1X and LLDP-MED and have the packets forwarded to a VoIP VLAN.

Multi Domain 802.1X Authentication

Multi-domain 802.1X authentication is an extension of multiple supplicant mode that allows one default VoIP device and multiple data devices to authenticate on a single port. Multi-domain 802.1X authentication provides enhanced security over multiple supplicant mode by restricting the number of authenticated data and VoIP sessions on the port. In multiple supplicant mode, any number of VoIP or data sessions can be authenticated; the number of sessions can be restricted using MAC limiting, but there is no way to apply the limit specifically to either data or VoIP sessions.

With multi-domain 802.1X authentication, the single port is divided into two domains; one is the data domain and the other is the voice domain. Multi-domain 802.1X authentication maintains separate session counts based on the domain. You can configure the maximum number of authenticated data sessions allowed on the port. The number of VoIP sessions is not configurable; only one authenticated VoIP session is allowed on the port.

If a new client attempts to authenticate on the interface after the maximum session count has been reached, the default action is to drop the packet and generate an error log message. You can also configure the action to shut down the interface. The port can be manually recovered from the down state by issuing the clear dot1x recovery-timeout command, or by can recover automatically after a configured recovery timeout period.

Multi-domain authentication does not enforce the order of device authentication. However, for the best results, the VoIP device should be authenticated before a data device on a multi domain 802.1X-enabled port. Multi-domain authentication is supported only in multiple supplicant mode.

Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones. The Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) protocol forwards VoIP parameters from the switch to the phone. You also configure 802.1X authentication to allow the telephone access to the LAN. Authentication is done through a backend RADIUS server.

This example describes how to configure VoIP on an EX Series switch to support an Avaya IP phone, as well as the LLDP-MED protocol and 802.1X authentication:

Note:

If your switch runs Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style, see Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch with ELS Support. For ELS details, see Using the Enhanced Layer 2 Software CLI.

Requirements

This example uses the following hardware and software components:

  • Junos OS Release 9.1 or later for EX Series switches

  • One EX Series switch acting as an authenticator port access entity (PAE). The interfaces on the authenticator PAE form a control gate that blocks all traffic to and from supplicants until they are authenticated.

  • An Avaya 9620 IP telephone that supports LLDP-MED and 802.1X

Before you configure VoIP, be sure you have:

Note:

If the IP address isn't configured on the Avaya IP phone, the phone exchanges LLDP-MED information to get the VLAN ID for the voice VLAN. You must configure the voip statement on the interface to designate the interface as a VoIP interface and allow the switch to forward the VLAN name and VLAN ID for the voice VLAN to the IP telephone. The IP telephone then uses the voice VLAN (that is, it references the voice VLAN’s ID) to send a DHCP discover request and exchange information with the DHCP server (voice gateway).

Overview and Topology

Instead of using a regular telephone, you connect an IP telephone directly to the switch. An IP phone has all the hardware and software needed to handle VoIP. You also can power an IP telephone by connecting it to one of the Power over Ethernet (PoE) interfaces on the switch.

In this example, the access interface ge-0/0/2 on the EX4200 switch is connected to an Avaya 9620 IP telephone. Avaya phones have a built-in bridge that allows you to connect a desktop PC to the phone, so the desktop and phone in a single office require only one interface on the switch. The EX Series switch is connected to a RADIUS server on interface ge-0/0/10 (see Figure 3).

Figure 3: VoIP TopologyVoIP Topology

In this example, you configure VoIP parameters and specify the forwarding class assured-forward for voice traffic to provide the highest quality of service.

Table 1 describes the components used in this VoIP configuration example.

Table 1: Components of the VoIP Configuration Topology
Property Settings

Switch hardware

EX4200 switch

VLAN names

data-vlan

voice-vlan

Connection to Avaya phone—with integrated hub, to connect phone and desktop PC to a single interface (requires PoE)

ge-0/0/2

One RADIUS server

Provides backend database connected to the switch through interface ge-0/0/10.

As well as configuring a VoIP for interface ge-0/0/2, you configure:

  • 802.1X authentication. Authentication is set to multiple supplicant to support more than one supplicant's access to the LAN through interface ge-0/0/2.

  • LLDP-MED protocol information. The switch uses LLDP-MED to forward VoIP parameters to the phone. Using LLDP-MED ensures that voice traffic gets tagged and prioritized with the correct values at the source itself. For example, 802.1p class of service and 802.1Q tag information can be sent to the IP telephone.

    Note:

    A PoE configuration is not necessary if an IP telephone is using a power adapter.

Configuration

To configure VoIP, LLDP-MED, and 802.1X authentication:

Procedure

CLI Quick Configuration

To quickly configure VoIP, LLDP-MED, and 802.1X, copy the following commands and paste them into the switch terminal window:

Step-by-Step Procedure

To configure VoIP with LLDP-MED and 802.1X:

  1. Configure the VLANs for voice and data:

  2. Associate the VLAN data-vlan with the interface:

  3. Configure the interface as an access interface, configure support for Ethernet switching, and add the data-vlan VLAN:

  4. Configure VoIP on the interface and specify the assured-forwarding forwarding class to provide the most dependable class of service:

  5. Configure LLDP-MED protocol support:

  6. To authenticate an IP phone and a PC connected to the IP phone on the interface, configure 802.1X authentication support and specify multiple supplicant mode:

    Note:

    If you do not want to authenticate any device, skip the 802.1X configuration on this interface.

Results

Display the results of the configuration:

Verification

To confirm that the configuration is working properly, perform these tasks:

Verifying LLDP-MED Configuration

Purpose

Verify that LLDP-MED is enabled on the interface.

Action
Meaning

The show lldp detail output shows that both LLDP and LLDP-MED are configured on the ge-0/0/2.0 interface. The end of the output shows the list of supported LLDP basic TLVs, 802.3 TLVs, and LLDP-MED TLVs that are supported.

Verifying 802.1X Authentication for IP Phone and Desktop PC

Purpose

Display the 802.1X configuration to confirm that the VoIP interface has access to the LAN.

Action
Meaning

The field Role shows that the ge-0/0/2.0 interface is in the authenticator state. The Supplicant field shows that the interface is configured in multiple supplicant mode, permitting multiple supplicants to be authenticated on this interface. The MAC addresses of the supplicants currently connected are displayed at the bottom of the output.

Verifying the VLAN Association with the Interface

Purpose

Display the interface state and VLAN membership.

Action
Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data-vlan VLAN and voice-vlan VLAN. The State field shows that the interface is up.

Example: Configuring VoIP on an EX Series Switch Without Including LLDP-MED Support

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones. The Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) protocol is sometimes used with IP phones to forward VoIP parameters from the switch to the phone. However, not all IP phones support LLDP-MED.

This example describes how to configure VoIP on an EX Series switch without using LLDP-MED:

Requirements

This example uses the following hardware and software components:

  • One EX Series switch with support for ELS acting as an authenticator port access entity (PAE). The interfaces on the authenticator PAE form a control gate that blocks all traffic to and from supplicants until they are authenticated.

  • An IP phone that does not support LLDP-MED.

  • Junos OS Release 13.2X50 or later for EX Series switches.

Before you configure VoIP, be sure you have:

Overview

Instead of using a regular telephone, you connect an IP telephone directly to the switch. An IP phone has all the hardware and software needed to handle VoIP. You can also power an IP telephone by connecting it to one of the Power over Ethernet (PoE) interfaces on the switch.

EX Series switches can accommodate an IP telephone and end host connected to a single switch port. In such a scenario, voice and data traffic must be separated into different broadcast domains, or VLANs. One method for accomplishing this is by configuring a voice VLAN, which enables access ports to accept untagged data traffic as well as tagged voice traffic from IP phones, and associate each type of traffic with separate and distinct VLANs. Voice traffic (tagged) can then be treated differently, generally with a higher priority than data traffic (untagged).

The voice VLAN delivers the greatest benefit when used with IP phones that support LLDP-MED, but it is flexible enough that IP phones that do not support LLDP-MED can also use it effectively. However, in the absence of LLDP-MED, the voice VLAN ID must be set manually on the IP phone because LLDP-MED is not available to accomplish this dynamically. For information about setting up a voice VLAN for IP phones that support LLDP-MED, see Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch with ELS Support.

Another method to separate voice (tagged) and data (untagged) traffic into different VLANs is to use a trunk port with the native VLAN ID option. The trunk port is added as a member of the voice VLAN, and processes only tagged voice traffic from that VLAN. The trunk port must also be configured with the native VLAN ID for the data VLAN so that it can process untagged data traffic from the data VLAN. This configuration also requires that the voice VLAN ID be set manually on the IP phone.

This example illustrates both methods. In this example, the interface ge-0/0/2 on the switch is connected to a non-LLDP-MED IP phone.

Note:

The implementation of a voice VLAN on an IP telephone is vendor-specific. Consult the documentation that came with your IP telephone for instructions on configuring a voice VLAN. For example, on an Avaya phone, you can ensure that the phone gets the correct VoIP VLAN ID even in the absence of LLDP-MED by enabling DHCP option 176.

Topology

Configuring VoIP Without LLDP-MED by Using a Voice VLAN on an Access Port

Procedure

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

Step-by-Step Procedure
  1. Configure two VLANs: one for data traffic and one for voice traffic:

    Note:

    The voice VLAN ID must be set manually on the IP phone.

  2. Associate the VLAN data-vlan with the interface ge-0/0/2:

  3. Configure the interface ge-0/0/2 as an access port belonging to the data VLAN:

  4. Configure VoIP on the interface ge-0/0/2 and add this interface to the voice VLAN:

  5. Specify the assured-forwarding forwarding class to provide the most dependable class of service:

Results

Display the results of the configuration:

Configuring VoIP Without LLDP-MED by Using a Trunk Port with Native VLAN Option

Procedure

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

Step-by-Step Procedure
  1. Configure two VLANs: one for data traffic and one for voice traffic:

    Note:

    The voice VLAN ID must be set manually on the IP phone.

  2. Configure interface ge-0/0/2 as a trunk port that includes only the voice VLAN:

  3. Configure the native VLAN ID for the data VLAN on the trunk port:

Results

Display the results of the configuration:

Verification

To confirm that the configuration is working properly, perform the following task:

Verifying the VLAN Association With the Interface

Purpose

Display the interface state and VLAN membership.

Action
Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data VLAN, data-vlan, and the voice VLAN, voice-vlan. The State field shows that the interface is up.

Example: Configuring VoIP on an EX Series Switch Without Including LLDP-MED Support

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones. The Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) protocol is sometimes used with IP phones to forward VoIP parameters from the switch to the phone. However, not all IP phones support LLDP-MED.

This example describes how to configure VoIP on an EX Series switch without using LLDP-MED:

Requirements

This example uses the following hardware and software components:

  • One EX4200 switch acting as an authenticator port access entity (PAE). The interfaces on the authenticator PAE form a control gate that blocks all traffic to and from supplicants until they are authenticated.

  • An IP phone that does not support LLDP-MED.

  • Junos OS Release 9.1 or later for EX Series switches.

Before you configure VoIP, be sure you have:

Overview

Instead of using a regular telephone, you connect an IP telephone directly to the switch. An IP phone has all the hardware and software needed to handle VoIP. You can also power an IP telephone by connecting it to one of the Power over Ethernet (PoE) interfaces on the switch.

EX Series switches can accommodate an IP telephone and end host connected to a single switch port. In such a scenario, voice and data traffic must be separated into different broadcast domains, or VLANs. One method for accomplishing this is by configuring a voice VLAN, which enables access ports to accept untagged data traffic as well as tagged voice traffic from IP phones, and associate each type of traffic with separate and distinct VLANs. Voice traffic (tagged) can then be treated differently, generally with a higher priority than data traffic (untagged).

The voice VLAN delivers the greatest benefit when used with IP phones that support LLDP-MED, but it is flexible enough that IP phones that do not support LLDP-MED can also use it effectively. However, in the absence of LLDP-MED, the voice VLAN ID must be set manually on the IP phone because LLDP-MED is not available to accomplish this dynamically. For information about setting up a voice VLAN for IP phones that support LLDP-MED, see Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch.

Another method to separate voice (tagged) and data (untagged) traffic into different VLANs is to use a trunk port with the native VLAN ID option. The trunk port is added as a member of the voice VLAN, and processes only tagged voice traffic from that VLAN. The trunk port must also be configured with the native VLAN ID for the data VLAN so that it can process untagged data traffic from the data VLAN. This configuration also requires that the voice VLAN ID be set manually on the IP phone.

This example illustrates both methods. In this example, the interface ge-0/0/2 on the EX4200 switch is connected to a non-LLDP-MED IP phone.

Note:

The implementation of a voice VLAN on an IP telephone is vendor-specific. Consult the documentation that came with your IP telephone for instructions on configuring a voice VLAN. For example, on an Avaya phone, you can ensure that the phone gets the correct VoIP VLAN ID even in the absence of LLDP-MED by enabling DHCP option 176.

Topology

Configuring VoIP Without LLDP-MED by Using a Voice VLAN on an Access Port

Procedure

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

Step-by-Step Procedure
  1. Configure two VLANs: one for data traffic and one for voice traffic:

    Note:

    The voice VLAN ID must be set manually on the IP phone.

  2. Configure the VLAN data-vlan on the interface ge-0/0/2:

  3. Configure the interface ge-0/0/2 as an access port belonging to the data VLAN:

  4. Configure VoIP on the interface ge-0/0/2 and add this interface to the voice VLAN:

Results

Display the results of the configuration:

Configuring VoIP Without LLDP-MED by Using a Trunk Port with Native VLAN Option

Procedure

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

Step-by-Step Procedure
  1. Configure two VLANs: one for data traffic and one for voice traffic:

    Note:

    The voice VLAN ID must be set manually on the IP phone.

  2. Configure interface ge-0/0/2 as a trunk port that includes only the voice VLAN:

  3. Configure the native VLAN ID for the data VLAN on the trunk port:

Results

Display the results of the configuration:

Verification

To confirm that the configuration is working properly, perform the following task:

Verifying the VLAN Association With the Interface

Purpose

Display the interface state and VLAN membership.

Action
Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data VLAN, data-vlan, and the voice VLAN, voice-vlan. The State field shows that the interface is up.

Example: Configuring VoIP on an EX Series Switch Without Including 802.1X Authentication

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones.

To configure VoIP on an EX Series switch to support an IP phone that does not support 802.1X authentication, you must either add the MAC address of the phone to the static MAC bypass list or enable MAC RADIUS authentication on the switch.

This example describes how to configure VoIP on an EX Series switch without 802.1X authentication using static MAC bypass of authentication:

Requirements

This example uses the following hardware and software components:

  • Junos OS Release 9.1 or later for EX Series switches

  • An IP telephone

Before you configure VoIP, be sure you have:

Note:

If the IP address isn't configured on the Avaya IP phone, the phone exchanges LLDP-MED information to get the VLAN ID for the voice VLAN. You must configure the voip statement on the interface to designate the interface as a VoIP interface and allow the switch to forward the VLAN name and VLAN ID for the voice VLAN to the IP telephone. The IP telephone then uses the voice VLAN (that is, it references the voice VLAN’s ID) to send a DHCP discover request and exchange information with the DHCP server (voice gateway).

Overview

Instead of using a regular telephone, you connect an IP telephone directly to the switch. An IP phone has all the hardware and software needed to handle VoIP. You also can power an IP telephone by connecting it to one of the Power over Ethernet (PoE) interfaces on the switch.

In this example, the access interface ge-0/0/2 on the EX4200 switch is connected to a non-802.1X IP phone.

To configure VoIP on an EX Series switch to support an IP phone that does not support 802.1X authentication, add the MAC address of the phone as a static entry in the authenticator database and set the supplicant mode to multiple.

Configuration

To configure VoIP without 802.1X authentication:

Procedure

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

Step-by-Step Procedure

To configure VoIP without 802.1X:

  1. Configure the VLANs for voice and data:

  2. Associate the VLAN data-vlan with the interface:

  3. Configure the interface as an access interface, configure support for Ethernet switching, and add the data-vlan VLAN:

  4. Configure VoIP on the interface and specify the assured-forwarding forwarding class to provide the most dependable class of service:

  5. Configure LLDP-MED protocol support:

  6. Set the authentication profile (see Configuring 802.1X Interface Settings (CLI Procedure) and Configuring 802.1X RADIUS Accounting (CLI Procedure)):

  7. Add the MAC address of the phone to the static MAC bypass list:

  8. Set the supplicant mode to multiple:

Results

Display the results of the configuration:

Verification

To confirm that the configuration is working properly, perform these tasks:

Verifying LLDP-MED Configuration

Purpose

Verify that LLDP-MED is enabled on the interface.

Action
Meaning

The show lldp detail output shows that both LLDP and LLDP-MED are configured on the ge-0/0/2.0 interface. The end of the output shows the list of supported LLDP basic TLVs, 802.3 TLVs, and LLDP-MED TLVs that are supported.

Verifying Authentication for the Desktop PC

Purpose

Display the 802.1X configuration for the desktop PC connected to the VoIP interface through the IP phone.

Action

Meaning

The field Role shows that the ge-0/0/2.0 interface is in the authenticator state. The Supplicant field shows that the interface is configured in multiple supplicant mode, permitting multiple supplicants to be authenticated on this interface. The MAC addresses of the supplicants currently connected are displayed at the bottom of the output.

Verifying the VLAN Association with the Interface

Purpose

Display the interface state and VLAN membership.

Action
Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data-vlan VLAN and voice-vlan VLAN. The State field shows that the interface is up.

Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch with ELS Support

Note:

This example uses Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style. If your switch runs software that does not support ELS, see Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch. For ELS details, see Using the Enhanced Layer 2 Software CLI.

You can configure VoIP on an EX Series switch to support IP telephones. The Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) protocol forwards VoIP parameters from the switch to the phone. You also configure 802.1X authentication to allow the telephone access to the LAN. Authentication is done through a backend RADIUS server.

This example describes how to configure VoIP on an EX Series switch to support an Avaya IP phone, as well as how to configure the LLDP-MED protocol and 802.1X authentication:

Requirements

This example uses the following software and hardware components:

Note:

This example also applies to QFX5100 switches.

  • Junos OS Release 13.2X50 or later for EX Series switches

  • One EX Series switch with support for ELS acting as an authenticator port access entity (PAE). The interfaces on the authenticator PAE form a control gate that blocks all traffic to and from supplicants until they are authenticated.

  • An Avaya IP telephone that supports LLDP-MED and 802.1X

Before you configure VoIP, be sure you have:

Note:

If the IP address is not configured on the Avaya IP phone, the phone exchanges LLDP-MED information to get the VLAN ID for the voice VLAN. You must configure the voip statement on the interface to designate the interface as a VoIP interface and allow the switch to forward the VLAN name and VLAN ID for the voice VLAN to the IP telephone. The IP telephone then uses the voice VLAN (that is, it references the voice VLAN’s ID) to send a DHCP discover request and exchange information with the DHCP server (voice gateway).

Overview and Topology

Instead of using a regular telephone, you connect an IP telephone directly to the switch. An IP phone has all the hardware and software needed to handle VoIP. You also can power an IP telephone by connecting it to one of the Power over Ethernet (PoE) interfaces on the switch.

EX Series switches can accommodate an IP telephone and end host connected to a single switch port. In such a scenario, voice and data traffic must be separated into different broadcast domains, or VLANs. One method for accomplishing this is by configuring a voice VLAN, which enables access ports to accept untagged data traffic as well as tagged voice traffic from IP phones, and associate each type of traffic with separate and distinct VLANs. Voice traffic (tagged) can then be treated differently, generally with a higher priority than data traffic (untagged).

Note:

If a MAC addresses has been learned on both the data and voice VLANs, it remains active unless it ages out of both VLANs, or both VLANs are deleted.

In this example, the access interface ge-0/0/2 on the EX Series switch is connected to an Avaya IP telephone. Avaya phones have a built-in bridge that enables you to connect a desktop PC to the phone, so the desktop and phone in a single office require only one interface on the switch. The EX Series switch is connected to a RADIUS server on the ge-0/0/10 interface (see Figure 4).

Note:

This figure also applies to QFX5100 switches.

Figure 4: VoIP TopologyVoIP Topology

In this example, you configure VoIP parameters and specify the forwarding class assured-forward for voice traffic to provide the highest quality of service.

Table 2 describes the components used in this VoIP configuration example.

Table 2: Components of the VoIP Configuration Topology
Property Settings

Switch hardware

EX Series switch with support for ELS.

VLAN names and IDs

data-vlan, 77

voice-vlan, 99

Connection to Avaya phone—with integrated hub, to connect phone and desktop PC to a single interface (requires PoE)

ge-0/0/2

One RADIUS server

Provides backend database connected to the switch through interface ge-0/0/10.

Besides configuring a VoIP for interface ge-0/0/2, you configure:

  • 802.1X authentication. Authentication is set to multiple supplicant mode to support more than one supplicant's access to the LAN through interface ge-0/0/2.

  • LLDP-MED protocol information. The switch uses LLDP-MED to forward VoIP parameters to the phone. Using LLDP-MED ensures that voice traffic gets tagged and prioritized with the correct values at the source itself. For example, 802.1p class of service and 802.1Q tag information can be sent to the IP telephone.

    Note:

    A PoE configuration is not necessary if an IP telephone uses a power adapter.

Topology

Configuration

Procedure

CLI Quick Configuration

To quickly configure VoIP, LLDP-MED, and 802.1X, copy the following commands and paste them into the switch terminal window:

Step-by-Step Procedure

To configure VoIP with LLDP-MED and 802.1X:

  1. Configure the VLANs for voice and data:

  2. Associate the VLAN data-vlan with the interface:

  3. Configure the interface as an access interface, configure support for Ethernet switching, and add the interface as a member of the data-vlan VLAN:

  4. Configure VoIP on the interface and specify the assured-forwarding forwarding class to provide the most dependable class of service:

  5. Configure LLDP-MED protocol support:

  6. To authenticate an IP phone and a PC connected to the IP phone on the interface, configure 802.1X authentication support and specify multiple supplicant mode:

    Note:

    If you do not want to authenticate any device, skip the 802.1X configuration on this interface.

Results

Display the results of the configuration:

Verification

To confirm that the configuration is working properly, perform these tasks:

Verifying LLDP-MED Configuration

Purpose

Verify that LLDP-MED is enabled on the interface.

Action
Meaning

The show lldp detail output shows that both LLDP and LLDP-MED are configured on the ge-0/0/2 interface. The end of the output shows the list of supported LLDP basic management TLVs and organizationally specific TLVs that are supported.

Verifying 802.1X Authentication for IP Phone and Desktop PC

Purpose

Display the 802.1X configuration to confirm that the VoIP interface has access to the LAN.

Action
Meaning

The field Role shows that the ge-0/0/2.0 interface is in the authenticator state. The Supplicant mode field shows that the interface is configured in multiple supplicant mode, permitting multiple supplicants to be authenticated on this interface. The MAC addresses of the supplicants currently connected are displayed at the bottom of the output.

Verifying the VLAN Association with the Interface

Purpose

Display the interface’s VLAN membership.

Action
Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data-vlan VLAN and voice-vlan VLAN.

Example: Configuring VoIP on an EX Series Switch with ELS Support Without Including 802.1X Authentication

Note:

This example uses Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style. If your switch runs software that does not support ELS, see Example: Configuring VoIP on an EX Series Switch Without Including 802.1X Authentication. For ELS details, see Using the Enhanced Layer 2 Software CLI.

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones.

To configure VoIP on an EX Series switch to support an IP phone that does not support 802.1X authentication, you must either add the MAC address of the phone to the static MAC bypass list or enable MAC RADIUS authentication on the switch.

This example describes how to configure VoIP on an EX Series switch without 802.1X authentication by using static MAC bypass of authentication:

Requirements

This example uses the following hardware and software components:

Note:

This figure also applies to QFX5100 switches.

  • One EX Series switch with support for ELS

  • Junos OS Release 13.2 or later for EX Series switches

  • An Avaya IP telephone

Before you configure VoIP, be sure you have:

Note:

If the IP address is not configured on the Avaya IP phone, the phone exchanges LLDP-MED information to get the VLAN ID for the voice VLAN. You must configure the voip statement on the interface to designate the interface as a VoIP interface and allow the switch to forward the VLAN name and VLAN ID for the voice VLAN to the IP telephone. The IP telephone then uses the voice VLAN (that is, it references the voice VLAN’s ID) to send a DHCP discover request and exchange information with the DHCP server (voice gateway).

Overview

Instead of using a regular telephone, you connect an IP telephone directly to the switch. An IP phone has all the hardware and software needed to handle VoIP. You also can power an IP telephone by connecting it to one of the Power over Ethernet (PoE) interfaces on the switch.

In this example, the access interface ge-0/0/2 on the EX Series switch is connected to a non-802.1X IP phone.

To configure VoIP on an EX Series switch to support an IP phone that does not support 802.1X authentication, add the MAC address of the phone as a static entry in the authenticator database and set the supplicant mode to multiple.

Configuration

Procedure

CLI Quick Configuration

To quickly configure VoIP without using 802.1X authentication, copy the following commands and paste them into the switch terminal window:

Step-by-Step Procedure

To configure VoIP without 802.1X authentication:

  1. Configure the VLANs for voice and data:

  2. Configure the interface as an access interface, configure support for Ethernet switching, and add the interface as a member of the data-vlan VLAN:

  3. Configure VoIP on the interface and specify the assured-forwarding forwarding class to provide the most dependable class of service:

  4. Configure LLDP-MED protocol support:

  5. Set the authentication profile with the name auth-profile (see Configuring 802.1X Interface Settings (CLI Procedure) and Configuring 802.1X RADIUS Accounting (CLI Procedure)):

  6. Add the MAC address of the phone to the static MAC bypass list:

  7. Set the supplicant mode to multiple:

Results

Display the results of the configuration:

Verification

To confirm that the configuration is working properly, perform these tasks:

Verifying LLDP-MED Configuration

Purpose

Verify that LLDP-MED is enabled on the interface.

Action
Meaning

The show lldp detail command output shows that both LLDP and LLDP-MED are configured on the ge-0/0/2 interface. The end of the output shows the list of supported LLDP basic management TLVs and organizationally specific TLVs that are supported.

Verifying Authentication for the Desktop PC

Purpose

Display the 802.1X configuration for the desktop PC connected to the VoIP interface through the IP phone.

Action

Meaning

The field Role shows that the ge-0/0/2.0 interface is in the authenticator role. The Supplicant Mode field shows that the interface is configured in multiple supplicant mode, permitting multiple supplicants to be authenticated on this interface. The MAC addresses of the supplicants currently connected are displayed at the bottom of the output.

Verifying the VLAN Association with the Interface

Purpose

Display the interface’s VLAN membership.

Action
Meaning

The Vlan members field shows that the ge-0/0/2.0 interface supports both the data-vlan VLAN and voice-vlan VLAN.