I ran into this again last week and I thought it might be a good idea to put this in writing for people who have made the choice to move to HP switches and still want to use the Cisco UC&C platform. This is the HP Comware platforms configuration, I hope to hit the lab and write up a ProVision configuration as well in the near future. This is ONE way of doing this. For anyone considering implementing this, or any other technology, please read the documentation and try and understand what you’re typing in. There are a couple of different ways to get this to work, this is just the one I prefer as it’s easy for legacy Cisco folk to understand what’s been done in the configuration.
Debunking the Myths
Cisco Phones need Cisco PoE
It’s true that Cisco was the first vendor to release Power Over Ethernet Switches. Inline power ( as it was called in those days ) was first released on the Cisco 3500XL switches back in the day. This was different and proprietary version of the 802.3af standard that we all know and love today. Fortunately for Cisco, and unfortunately for many customers, the second generation of Cisco Phones, the 7940/7960 era was only powered by Cisco’s Inline Power standard. They just wouldn’t come up with standards-based 802.3af power.
This means that many customers had no choice but to buy the Cisco switches to support the Cisco phones. You always had the option of buying a power brick per phone at a cost of about 60$ a piece. Management nightmare. I only saw one customer ever do that. ( twitch twitch… twitch twitch… ok. I’m ok now )
There are a LOT of customers who still have those device in their environments, So the question becomes:
Can I still use HP switches if I have old Cisco phones? Cisco told me that my Cisco phones don’t work on HP switches.
The answer is: Yes. They will absolutely work! HP has done the work to get older phones to work on both the Comware and ProVision devices. This blog is Comware focused, but I’ll try to get back with a ProVision configuration soon!
Configuring your HP Comware Switch to deliver PoE to Cisco Phones
On a Comware based switch, the commands you’ll need to use to get this working are the following at the global level
[HP_E5500EI]poe legacy enable pse 4
At the port level, you may also have to enable PoE on the port
[HP_E5500EI-GigabitEthernet1/0/1]poe enable
Cisco Phones need CDP to work
Once upon a time, CDP was the only neighbour discovery protocol in town. Cisco needed a way to push the voice vlan to their pre-standard phones, and CDP became the easiest way for them to do this. Most other vendors at this time were using specific DHCP options in a standards based environment. Then along came LLDP and LLDP-MED. Other than the isolated cases where the customer still has the original second generation Cisco Phones in place, there is virtually no reason to be using CDP for the voice vlan today. LLDP works great and is supported by all the leading telephony vendors, including Cisco phones since around 2007. (You might need newer firmware on your phones.)
So the question is:
How do I setup my HP switch to send the right voice vlan to my cisco phone using LLDP? And what about my older phones? Are you telling me I have to buy all new phones to move to HP?
The answer: Yes, we can use lldp, and No, you don’t have to buy new phones.
Especially in an era of Microsoft Lync, I’m starting to see more and more customers with a mobile work force who are starting to abandon the traditional handset mentality. Or in some cases, it’s even better for the business because employees are actually bringing in their own mobile devices and installing the Microsoft Lync client. Who would have thought we would ever be happy having to buy our own phones for work? 🙂
So on to the configuration, I’m going to do two configurations here and it will quickly become clear why. For older Cisco CDP phones, HP Comware switches use the MAC Address OUI (object unique identifier ) which is basically the first half of the MAC address that is assigned to a specific vendor. What this means is that for some Cisco environments who have been buying phones over a few years, you could end up having to manage a TON of MAC addresses OUIs in your switch configurations. The first example will be the quick way, although arguably slightly less insecure, to assign Voice VLANs to legacy Cisco Phones. Although arguably, if you’re concerned about security in your environment, I would recommend that you replace all your legacy Cisco phones anyways considering the ( Legacy Cisco Phones allowed a packet capture on the PC port to capture Voice VLAN traffic as well. )
For those who really want to do this the “right way”, you’ll still need to run the undo commands and replace the single voice clan mac-address statement in this configuration snippet with the 128 lines included at the end of this blog. ( Anyone know why Cisco burned through so many? Seriously? That’s a LOT of OUIs! I’m SURE they could have handled this with a lot less!).
The Environment
As you can see this is a pretty simple environment. CCM in VLAN10 connected to a HP 5500EI switch. The phone is directly connected to the switch on interface gigabit 1/0/5 and the PC is plugged into the phone. The Phone should be sending all Voice traffic tagged on VLAN 20 and the PC should be sending all traffic untagged on VLAN 30.
Any questions?
Configuring your HP Comware Switch to deliver the Voice VLAN to Cisco Phones
The following commands are all performed at the global level.
- #The following commands are used to disable the factory mac-address OUIs.
- undo voice vlan mac-address 0001-e300-0000
- undo voice vlan mac-address 0003-6b00-0000
- undo voice vlan mac-address 0004-0d00-0000
- undo voice vlan mac-address 0060-b900-0000
- undo voice vlan mac-address 00d0-1e00-0000
- undo voice vlan mac-address 00e0-7500-0000
- undo voice vlan mac-address 00e0-bb00-0000
- #These command creates a couple of mac-oui’s which will respond to any LLDP-MED or CDP capable phone plugs into the network.
- voice vlan mac-address 0000-0000-0000 mask ff00-0000-0000
- voice vlan mac-address 8000-0000-0000 mask ff00-0000-0000
- undo voice vlan security enable
note: We need the large “any oui” wildcards to support the number of non-contiguous and broad range of Cisco Prefixes.
- # You must Globally enable LLDP
- lldp enable
- # You must enable LLDP for CDP Compliance mode
- lldp compliance cdp
As you can see above, instead of having hundreds of voice vlan mac-address… with all of the Cisco OUI ( scroll to the bottom for a list of the different Cisco specific mac-address OUIs that my peers and I have collected over the years ), you can instead put in a single statement that will allow you to send out the voice VLAN when any Cisco phone plugs into the network.
Now for the interface specific commands
- interface GigabitEthernet1/0/5
- port link-mode bridge <– Switchport, Could be a routed port, but that won’t work here.
- port link-type trunk <– Turns the port into a dot1q trunk. You need this to carry a tagged VLAN across the wire
- port trunk pvid vlan 30 <– Tells the port that it’s untagged VLAN is 30.
- undo port trunk permit vlan 1 <– Removes VLAN 1 from the trunk port. Not necessary for this to work.
- port trunk permit vlan 20 30 <– Allows the trunk to carry traffic from both the designated Voice and the Data VLANs.
- undo voice vlan mode auto <– Turns off voice clan auto mode.
- voice vlan 20 enable <– Tells the switch to advertise dot1q VLAN 20 as the Voice VLAN via LLDP-MED and CDP on this port.
- broadcast-suppression pps 3000
- undo jumboframe enable
- apply poe-profile index 1 <– This calls to a centrally defined PoE profile.
- stp edged-port enable <– similar to port fast in Cisco terms.
- lldp compliance admin-status cdp txrx <– Allows read/write of CDPv2 packets on this port.
The Right Way vs. Reality
As most of you already know, the real world is messy. There are very often tradeoffs in the world, mostly in the way of time. The method I showed above does indeed work, and it removes the operation burden of having to keep track of Cisco’s unique mac-address OUIs. Is it the most secure method in the world? Probably not, but security is always a tradeoff between how difficult it is to implement and operate and how important it is to secure the information asset in question.
Most phone calls just aren’t that important to be honest.
But… for those of you who really insist on doing this the “right way”, I’ve included this non exhaustive list of the unique mac-address OUIs that Cisco has put on their phone models over the years. This is something that my peers and I have put together over the years and hopefully it might help someone out there. If anyone does have additional Cisco Phone OUIs that are not included in this list. Please post them in the comments and I would be happy to update them here!
Hopefully someone will find this helpful. If you do notice that something has changed and this configuration doesn’t work for you; Please feel free to drop me a line and let me know. I’ll be happy to update my blog. I’d rather be wrong and someone tell me than just thinking I’m right. : )
@netmanchris
List of Cisco Phone Mac-address OUIs
- voice vlan mac-address 0002-B900-0000
- voice vlan mac-address 0003-6B00-0000
- voice vlan mac-address 0003-E300-0000
- voice vlan mac-address 0005-3200-0000
- voice vlan mac-address 0005-9A00-0000
- voice vlan mac-address 0005-9B00-0000
- voice vlan mac-address 0006-D700-0000
- voice vlan mac-address 0007-0E00-0000
- voice vlan mac-address 0007-5000-0000
- voice vlan mac-address 0008-2100-0000
- voice vlan mac-address 000B-5F00-0000
- voice vlan mac-address 000B-BE00-0000
- voice vlan mac-address 000B-BF00-0000
- voice vlan mac-address 000c-ce00-0000
- voice vlan mac-address 000D-2900-0000
- voice vlan mac-address 000D-6500-0000
- voice vlan mac-address 000D-BC00-0000
- voice vlan mac-address 000D-ED00-0000
- voice vlan mac-address 000E-3800-0000
- voice vlan mac-address 000E-8400-0000
- voice vlan mac-address 000E-D700-0000
- voice vlan mac-address 000F-2300-0000
- voice vlan mac-address 000F-3400-0000
- voice vlan mac-address 000F-8F00-0000
- voice vlan mac-address 0011-2000-0000
- voice vlan mac-address 0011-2100-0000
- voice vlan mac-address 0011-5C00-0000
- voice vlan mac-address 0011-9300-0000
- voice vlan mac-address 0011-BB00-0000
- voice vlan mac-address 0012-0000-0000
- voice vlan mac-address 0012-7F00-0000
- voice vlan mac-address 0013-1900-0000
- voice vlan mac-address 0013-1A00-0000
- voice vlan mac-address 0013-7F00-0000
- voice vlan mac-address 0013-8000-0000
- voice vlan mac-address 0013-C300-0000
- voice vlan mac-address 0013-C400-0000
- voice vlan mac-address 0014-1C00-0000
- voice vlan mac-address 0014-6900-0000
- voice vlan mac-address 0014-6A00-0000
- voice vlan mac-address 0014-A900-0000
- voice vlan mac-address 0014-F200-0000
- voice vlan mac-address 0015-6200-0000
- voice vlan mac-address 0015-2B00-0000
- voice vlan mac-address 0015-F900-0000
- voice vlan mac-address 0015-FA00-0000
- voice vlan mac-address 0016-4600-0000
- voice vlan mac-address 0016-4700-0000
- voice vlan mac-address 0016-C800-0000
- voice vlan mac-address 0017-0E00-0000
- voice vlan mac-address 0017-5900-0000
- voice vlan mac-address 0017-5A00-0000
- voice vlan mac-address 0017-9400-0000
- voice vlan mac-address 0017-9500-0000
- voice vlan mac-address 0017-E000-0000
- voice vlan mac-address 0018-1800-0000
- voice vlan mac-address 0018-1900-0000
- voice vlan mac-address 0018-1D00-0000
- voice vlan mac-address 0018-7300-0000
- voice vlan mac-address 0018-B900-0000
- voice vlan mac-address 0018-BA00-0000
- voice vlan mac-address 0019-0600-0000
- voice vlan mac-address 0019-2F00-0000
- voice vlan mac-address 0019-3000-0000
- voice vlan mac-address 0019-AA00-0000
- voice vlan mac-address 0019-E700-0000
- voice vlan mac-address 0019-E800-0000
- voice vlan mac-address 001A-2F00-0000
- voice vlan mac-address 001A-6D00-0000
- voice vlan mac-address 001A-A100-0000
- voice vlan mac-address 001A-A200-0000
- voice vlan mac-address 001B-0C00-0000
- voice vlan mac-address 001B-2A00-0000
- voice vlan mac-address 001B-5300-0000
- voice vlan mac-address 001B-5400-0000
- voice vlan mac-address 001B-D400-0000
- voice vlan mac-address 001B-D500-0000
- voice vlan mac-address 001C-5800-0000
- voice vlan mac-address 001D-4500-0000
- voice vlan mac-address 001D-A200-0000
- voice vlan mac-address 001E-1300-0000
- voice vlan mac-address 001E-4A00-0000
- voice vlan mac-address 001E-7A00-0000
- voice vlan mac-address 001E-F700-0000
- voice vlan mac-address 001F-6C00-0000
- voice vlan mac-address 001F-9E00-0000
- voice vlan mac-address 0021-1B00-0000
- voice vlan mac-address 0021-5500-0000
- voice vlan mac-address 0021-A000-0000
- voice vlan mac-address 0022-5500-0000
- voice vlan mac-address 0022-9000-0000
- voice vlan mac-address 0023-0400-0000
- voice vlan mac-address 0023-5E00-0000
- voice vlan mac-address 0023-EB00-0000
- voice vlan mac-address 0024-9700-0000
- voice vlan mac-address 0025-8400-0000
- voice vlan mac-address 0026-0B00-0000
- voice vlan mac-address 0026-9900-0000
- voice vlan mac-address 0026-CB00-0000
- voice vlan mac-address 0030-9400-0000
- voice vlan mac-address 04C5-A400-0000
- voice vlan mac-address 04FE-7F00-0000
- voice vlan mac-address 0817-3500-0000
- voice vlan mac-address 081F-F300-0000
- voice vlan mac-address 108C-CF00-0000
- voice vlan mac-address 18EF-6300-0000
- voice vlan mac-address 1C17-D300-0000
- voice vlan mac-address 2893-FE00-0000
- voice vlan mac-address 3037-A600-0000
- voice vlan mac-address 5475-D000-0000
- voice vlan mac-address 58BC-2700-0000
- voice vlan mac-address 6416-8D00-0000
- voice vlan mac-address 68BD-AB00-0000
- voice vlan mac-address 68EF-BD00-0000
- voice vlan mac-address 6C50-4D00-0000
- voice vlan mac-address 9CAF-CA00-0000
- voice vlan mac-address A40C-C300-0000
- voice vlan mac-address A8B1-D400-0000
- voice vlan mac-address B414-8900-0000
- voice vlan mac-address B4A4-E300-0000
- voice vlan mac-address B8BE-BF00-0000
- voice vlan mac-address D057-4C00-0000
- voice vlan mac-address DC7B-9400-0000
- voice vlan mac-address E804-6200-0000
- voice vlan mac-address EC44-7600-0000
- voice vlan mac-address ECC8-8200-0000
- voice vlan mac-address F025-7200-0000
- voice vlan mac-address FCFB-FB00-0000
kontrolissues 
Good stuff! I just bought some 2910’s so I’ll figure out how to get the Provision stuff to work. Maybe I’ll post something.
I’m actually using LLDP/LLDP-MED on Juniper switches for my Cisco phones. It should be noted, to use the latest firmware of the phones. On my 79XX phones, they wouldn’t work at all until a certain firmware version, and even then, it was buggy until the latest version came out.
hey @neelixx
I’ve got a 2910 and a 3500yl in the lab. I’m already planing on putting together configs for both of those and post them as well.
Great info on the phone code. That was always an issue on earlier versions of call mangler.
I have just configured this for Avaya Phones and with a minor tweak “voice vlan mac-address 0004-f200-0000 mask ffff-ff00-0000” Worked really well – Thanks very much for this.
I just wanna say thank you !
This is excellent work and hard to extract from any doc.
I only have LLDP-MED Phones. Is the:
voice vlan mac-address xxxx-xxxx-xxxx
lldp compliance admin-status cdp txrx
needed?
Also I see a 2-3 minutes delay before phones start tagging frames to the voice vlan (it also grabs DHCP from native vlan in this period) as opposed to to 3800/2910 switches where voice vlan tagging is instant.
Any thoughts on this?
(Running HP 830 Unified WLAN switches)
Regards,
Henning
Recently had similar issue with Cisco AP and HP1920-8G-PoE+ switch. Switch did not supplied enough power for AP to power on radios. AP requests more power via CDP.
in this case “poe legacy enable” is not needed, even more, it interferes. Although i suspect it can be fixed by enabling “Pre-standard 802.3af switches” on AP properties on WLC.
anyway
lldp compliance cdp
and
lldp compliance admin-status cdp txrx
on port did the trick.
I must add, although Cisco latest APs use 802.3af they also talk CDP which throws switch off i suspect.
hey Marcus,
Just capturing our Twitter convo here. I don’t think the PoE Legacy enable command would have done anything here.
This command was used to allow the switches to be able to provide power compatible with the original Cisco Inline power spec which was pre 802.3af. I think the 3524xl was the only switch that I remember using this standard and it was only the original 79xx series ( 7940, 7960, etc…) phones that required this as well.
Glad this piece was able to at least get you pointed in the right direction though.
@netmanchris
This was one of the better write up’s about.. good work.
To add to the list incase it helps someone along the lines…
I encountered an issue with 5510 devices on Comware 7 and Cisco Phones
CP-9971 – Running 9-3-2-10
CP-8945 – Running 9-3-4-17
The following configuration is what finally worked:
#
voice-vlan track lldp
#
lldp global enable
lldp compliance cdp
#
poe legacy enable pse 4
#
vlan 1
#
vlan 22
description data
#
vlan 48
description voice
#
interface range GigabitEthernet1/0/1 to Gig1/0/48
port link-mode bridge
port link-type hybrid
undo port hybrid vlan 1
port hybrid vlan 48 tagged
port hybrid vlan 22 untagged
port hybrid pvid vlan 22
stp edged-port
lldp compliance admin-status cdp txrx
cdp voice-vlan 48
lldp tlv-enable med-tlv network-policy 48
qos trust dscp
poe enable
poe max-power 13200
Hey @RobCraig,
Thanks very much for reposting this! It’s really nice to see that this article is still useful years after writing it. I’m glad it was helpful in figuring out the Comware7 version as well! I’m actually moving to a 5130 sone for an edge switch in my lab so it’s nice to already have this configuration waiting for my CISCO phones to plug into the switch.
Really appreciate the sharing of knowledge!
@netmanchris