MS120 - Voice VLAN Setup

[DunJer622]

Greetings,

Is there any good documentation for setting up a voice VLAN on an MS120-24P?  Just when I think I'm getting the hang of Meraki, I run into another detour.  The decision was made to leave the HP/Aruba 2530 line to go with the MS120 line.  With the HP switches, I'd simply create the VLANs (data, voice, etc.), define the voice VLAN as such (along with QoS and prioritization), assign them to ports, and then tag all voice traffic and untag all data traffic.  With SonicWALL routers, I'd use separate ports for uplinks (1 data and 1 voice).  At this point, I can connect one of my VoIP phones to the switch and it would get a DHCP-assigned IP address on the voice VLAN.  I can then connect a computer to the back of the phone and that computer will get a DHCP-assigned IP address on the data VLAN.  I'm struggling mightily to replicate this on my Meraki setup (MX65 is doing DHCP).  I've clicked on the Configuring Voice VLANs link within Advance MS Setup Guide, but it is rather useless.

This is a very big deal for us.

Any assistance would be greatly appreciated.

Thank you,

Jeremy  

[hoempf]

Hi

I'm with you, I struggled a bit to get my head around it the first time I used Meraki when I tried to replicate a Cisco Catalyst config 🙂

So basically (if I understood you correctly) you want to connect a phone on a switchport and be able to place the phone in the voice VLAN and the PC behind the phone in the "PC VLAN". Let's assume voice VLAN is VLAN20 and the PC VLAN is VLAN10.

Now you configure the port in access mode (not trunk), assign VLAN 10 to it and as voice VLAN use 20:

You don't have to "tag" or "untag" like on other vendor's switches, you also don't have to "create" the VLAN. This is done behind the scenes as soon as you assign a port to a VLAN (like in the screenshot).

In this configuration the switch basically tells the phone which VLAN it has to use for itself and which one for the PC port.

Assuming the phone is able to talk LLDP and knows what to do with the information the switch sends, it should connect to VLAN 20 and the PC behind it on VLAN 10. Some phones need some slight configuration to accept LLDP from a switch and use the suggested VLAN for itself. You probably find this in the documentation of the phone's manufacturer.

Then you can trunk those VLANs wherever you want, to an MX for example (via a trunk port). Configure QoS accordingly, either VLAN based or by DSCP (Switch --> Switch Settings).

HTH

[DunJer622]

Thanks, HTH.  That got me moving again.

I was able to replicate my previous setup, so that is progress.  So, now onto the next effort.  Currently, I have 2 physical ports (1 for data and 1 for voice) coming from the MX65 into the MS120.  Now I'm trying to reduce the link to a single cable from the MX65 to the MS120 (uplink).  I've tried multiple combinations of trunk and access configurations of the ports on both the MX65 and the MS120, but all configs have failed, with the phone usually failing to see the DHCP server or the computer behind the phone gets a voice VLAN IP.  Am I overlooking something simple, or am I stuck with using 2 separate ports?

Thanks,

Jeremy

[hoempf]

Hi Jeremy

Great you're making progress, awesome 🙂

So I suggest you first nail the connection between the MX and the switch. Let's try it this way:

I assume you have defined a data and voice VLAN, I replicated that in our Lab:

Consider it just an example, you of course don't have to follow the same IP numbering. I recommend creating a management network (we usually use VLAN1 for that, although we didn't do so in Cisco IOS environments, but those are a different story and we experienced it to be smoother this way with Meraki).

This management network is where all your Meraki devices (and only those) get their management IP from and get to the Internet and the Meraki cloud. 

Now on the MX switchports configure one port as a trunk with native VLAN1 and allow the other VLANs, like so:

Then connect this port to the switch (and only this port). I wouldn't recommend connecting more than one port because the MX does not do STP and you potentially create loops. For the sake of this example let's just connect one for now.

The port on the MS switch where you connect the MX to should have the exact same config as the MX LAN port in the screenshot above, like this:

All VLANs in the "allowed VLANs" section are tagged now and the native VLAN (1) isn't. Those configurations should match on a trunk port to work correctly.

Perhaps reboot the switch so it gets it's management address, make sure the management VLAN is 1. After it is green in the dashboard again, configure the port where the phone will be connected like I explained in the post before. Note that I used different VLANs this time, it's because we usually follow a VLAN numbering pattern for customers and I just took a quick screenshot of our lab MX, but just use the VLANs of your choice of course.

Also make sure you enabled DHCP on the MX for data and voice VLANs and that you allow the MX on the switch for DHCP (Switch -> DHCP Servers), default is allowed.

Now your phone should get the correct configuration and also the PC port on the phone.

If it doesn't then we should proceed to look at the phone's configuration, but let me know how it goes so far first 🙂

Cheers! 

[DunJer622]

Good morning.

I had an ISP issue over the weekend, so I just got back to this matter this morning.  Thanks for the details.  I followed your suggestions, but I keep running into a few problems.  The primary concern is that the phones are now picking up a data VLAN (20) address, instead of a voice VLAN (30) address.  The other issue is that the switch keeps stating that "DNS is misconfigured".  As such, the status never turns green, being yellow instead.  I also notice that the RSTP Root never resolves.

I also noticed that the clients (a laptop in this case) is not listing the correct port, as it is stating that it is in port 23, which is currently an uplink to a second switch.  the laptop is actually connected to a phone that is connected to port 1 on the switch.  The laptop is getting the correct address.

Any ideas?

Oh, one other thing.  As my network is 10.20.10.0/24, my standard practice is to have my switches statically assigned addresses in the same network.  In this case, the IPs would be 10.20.10.20 and 10.20.10.21 for these switches.  Before the addition of the Meraki Management VLAN (1), the IPs were accessible.  Now they are not.  Trying to statically assign them seems to be ignored.

Thank you,

Jeremy

[DunJer622]

OK.  For no apparent reason, as I haven't changed anything for over an hour, the primary switch went green with a management VLAN IP.  I then changed it to the preferred data VLAN IP and it took it and started responding.  One odd thing is that it is identifying the RSTP Root as the secondary switch.  I'd think that it would see itself.

Thanks,

Jeremy

[DunJer622]

Well, I'm not really sure why, but everything is now working exactly as expected.  That said, I'm not sure why this didn't work previously.  Anyhow, what I ended up doing was having my MX65 ports configured as a trunk with data VLAN (20) native and all VLANs allowed.  Upon connecting it to an MS120 port configured exactly the same and having the individual ports configured as access with the data VLAN (20) and the voice VLAN 30, the phones are now getting a 10.30.10.0 address and the computer behind it is getting a 10.20.10.0 address.  Rinse and repeat for the second switch.

I do have one additional question, though.  The current primary DNS for the switch is to our internal DNS (requires a VPN to be up).  Is this a bad plan?  Should I use a public DNS for this, to aid in communications to the Meraki dashboard?

Thanks,

Jeremy 

[hoempf]

Sorry I did not see you replied while I was writing 🙂

Glad to hear it‘s working now. I assume the switch finally got the configuration from the cloud. It depends on having clean access to the cloud to update itself.

I generally recommend to bring it up first and then connect stuff to it since for example a server on the switch doing DHCP could interfere with the first boot (when it has no configuration yet).

Regarding DNS: Yes it needs DNS. I think Meraki has a fallback in case DNS can‘t be resolved, they try very hard to get to the dashboard 🙂
I recommend configuring DNS server on the switches (and other Meraki gear) you can always reach, like 8.8.8.8 and 8.8.4.4 so you have clean DNS in case the tunnel or your server internally does not work. That‘s also why I recommend having a separate management VLAN, you can decouple management traffic from your normal traffic. Also security-wise it‘s easier this way, you could firewall off clients from the management address of your infrastructure by blocking traffic to the management subnet with a single firewall rule 🙂


Cheers!

[hoempf]

Hi Jeremy

When changing management of the switch it takes some time to update the dashboard, just have patience and make sure you're not on beta firmware, I had best results so far with 9.36, but I might be biased 😉 Also the switches try very hard to "get to" the Internet if they can't on their configured management VLAN or IP. That's usually when they complain with a yellow warning in the dashboard, even if you configured them statically. It's actually annoying the first time, but I was happy a few times now for that "feature".

I usually recommend not using the data VLAN as the management interfaces of the switches. This is just a general practice of ours and don't have to apply to your network of course. It makes things easier when using L3 features on the switches.

Back to the problem at hand 🙂

I very much suspect that either the phone is not capable of LLDP and/or a dedicated voice VLAN. It might be something that doesn't work out of the box but may be configured on the phone itself. May I ask what the phone model is we're talking about?

This is how it's looking in our lab:

If you don't see anything under CDP/LLDP your phone probably doesn't support it or is not configured for it. 

If that's really the case (you could check by looking up documentation on the phone if you have the model number / product id ready) then you may configure a trunk port, but this is generally undesirable since you loose access policies (802.1x) and other stuff.

Also regarding STP. You can set the priority of the switch you want to be root to 0 (lower number wins) in the dashboard (Switch --> Switch Settings --> STP configuration), like so:

Also do you have other (non-Meraki) switches connected to a Meraki switch? If that's the case make sure the STP on the other switch is compatible:

https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Configuring_RSTP_for_interoperabilit...

Cheers!