4-4VLANs are vulnerable to traffic attacks. Vicious users can forge a large amount of voice packetsand send them to voice VLAN-enabled ports to consume the voice VLAN bandwidth, affectingnormal voice communication.z Security mode: In this mode, only voice packets whose source MAC addresses comply with therecognizable OUI addresses can pass through the voice VLAN-enabled inbound port, while allother packets are dropped.In a safe network, you can configure the voice VLANs to operate in normal mode, thus reducing theconsumption of system resources due to source MAC addresses checking. It is recommended not totransmit both voice packets and non-voice packets in a voice VLAN. If you have to, please ensure thatthe voice VLAN security mode is disabled.Table 4-3 How a voice VLAN-enable port processes packets in security/normal modeVoice VLANworking mode Packet type Packet processing modeUntagged packetsPackets carrying thevoice VLAN tagIf the source MAC address of a packet matches an OUIaddress configured for the device, it is forwarded in thevoice VLAN; otherwise, it is dropped.Security modePackets carryingother tagsForwarded or dropped depending on whether the portallows packets of these VLANs to pass throughUntagged packetsPackets carrying thevoice VLAN tagThe port does not check the source MAC addresses ofinbound packets. All types of packets can be transmittedin the voice VLAN.Normal modePackets carryingother tagsForwarded or dropped depending on whether the portallows packets of these VLANs to pass throughConfiguring a Voice VLANConfiguration PrerequisitesBefore configuring a VLAN as a voice VLAN, create the VLAN first. Note that you cannot configureVLAN 1 (the system-default VLAN) as a voice VLAN.Setting a Port to Operate in Automatic Voice VLAN Assignment ModeFollow these steps to set a port to operate in automatic voice VLAN assignment mode:To do... Use the command... RemarksEnter system view system-view —Set the voice VLAN aging time voice vlan aging minutesOptional1440 minutes by default.The voice VLAN aging timeconfiguration is only applicableon ports in automatic voiceVLAN assignment mode.Enable the voice VLAN securitymode voice vlan security enable OptionalEnabled by default.
