144Security mode and normal mode of voice VLANsDepending on their inbound packet filtering mechanisms, voice VLAN-enabled ports operate in thefollowing modes:• Normal mode: Voice VLAN-enabled ports receive packets that carry the voice VLAN tag, andforward packets in the voice VLAN without comparing their source MAC addresses against the OUIaddresses configured for the device. If the PVID of the port is the voice VLAN and the port works inmanual VLAN assignment mode, the port forwards all received untagged packets in the voiceVLAN. In normal mode, voice VLANs are vulnerable to traffic attacks. Malicious users might sendlarge quantities of forged voice packets to consume the voice VLAN bandwidth, affecting normalvoice communication.• Security mode: Only voice packets whose source MAC addresses match the recognizable OUIaddresses can pass through the voice VLAN-enabled inbound port, but all other packets aredropped.In a safe network, you can configure the voice VLANs to operate in normal mode, reducing theconsumption of system resources due to source MAC addresses checking.TIP:H3C does not recommend you transmit both voice traffic and non-voice traffic in a voice VLAN. If youmust transmit both voice traffic and nonvoice traffic, make sure that the voice VLAN security mode isdisabled.Table 17 How a voice VLAN-enabled port processes packets in security and normal modeVoice VLANmode Packet type Packet processing modeUntagged packetsPackets that carry the voiceVLAN tagIf the source MAC address of a packet matches an OUIaddress configured for the device, it is forwarded in the voiceVLAN; otherwise, it is dropped.Security modePackets that carry othertagsForwarded or dropped depending on whether the port allowspackets of these VLANs to pass throughUntagged packetsPackets that carry the voiceVLAN tagThe port does not determine the source MAC addresses ofinbound packets. In this way, both voice traffic and non-voicetraffic can be transmitted in the voice VLAN.Normal modePackets that carry othertagsForwarded or dropped depending on whether the port allowspackets of these VLANs to pass throughConfiguring a voice VLANConfiguration prerequisitesBefore you configure a voice VLAN, complete the following tasks:• Create a VLAN.• Configure QoS priority settings for voice VLAN traffic on an interface before you enable voiceVLAN on the interface.
