3-3If an IP phone sends tagged voice traffic and its connecting port is configured with 802.1Xauthentication and guest VLAN, you should assign different VLAN IDs for the voice VLAN, the defaultVLAN of the connecting port, and the 802.1X guest VLAN.z The default VLANs for all ports are VLAN 1. You can configure the default VLAN of a port andconfigure a port to permit a certain VLAN to pass through with commands. For more information,refer to Port-Based VLAN Configuration.z Use the display interface command to display the default VLAN of a port and the VLANspermitted to pass through the port.Security Mode and Normal Mode of Voice VLANsVoice VLAN-enabled ports can operate in security mode or normal mode based on their inbound packetfiltering mechanisms.z Security mode: only voice packets whose source MAC addresses comply with the recognizableOUI addresses can pass through the voice VLAN-enabled inbound port, while other non-voicepackets are dropped, including authentication packets, such as 802.1X authentication packets.z Normal mode: both voice packets and non-voice packets are allowed to pass through a voiceVLAN-enabled inbound port. Voice packets are forwarded according to the voice VLAN forwardingmechanism whereas the non-voice packets are forwarded according to the normal VLANforwarding mechanism.It is recommended not to transmit both voice packets and non-voice packets in a voice VLAN. Ifnecessary, please ensure that the voice VLAN security mode is disabled.Configuring a Voice VLANConfiguration PrerequisitesBefore configuring a VLAN as a voice VLAN, create the VLAN first. Note that you cannot configureVLAN 1 (the system-default VLAN) as a voice VLAN.
