VLANs for voice?

Lately, I’ve heard many mentions, pro and con, of using virtual LANs to solve QoS challenges in wireless LANs. If like me, you’ve been confused by some of this talk, read on. 

First, several vendors agree that putting VoIP traffic onto a separate VLAN is a recommended best practice, but that doing so has more of a security benefit than a QoS advantage in the wireless portion of the network.

While wireless switch vendors such as Airespace, Aruba Wireless and Trapeze Networks, for example, do support multiple queues and service classes, and voice VLANs can take precedence over data VLANs, these are proprietary mechanisms. Nothing in the 802.11 standard dictates that an 802.11 network must recognize 802.1p or 802.1Q tags, for example, the way a wired Ethernet must.

And priority queues don’t necessarily buy you anything for scheduling, which will be one of the primary contributions of the forthcoming 802.11e QoS extension to the 802.11 standard (which is, in effect, a new MAC for 802.11).

Says Jon Leary, product line manager in Cisco’s wireless networking business unit: “A VLAN in and of itself won’t create QoS. It will help you classify traffic only. But then you must apply policy.”

He advocates using VLANs to segregate traffic. “Then, there’s the separate question about how to prioritize the voice VLAN over data traffic. And that’s really what the Wi-Fi standards body is working on.”

And while voice might get preferential treatment over the radio interface (using proprietary mechanisms today) queuing alone doesn’t guarantee anything about latency, which is also crucial to VoIP QoS. So the industry has largely used the SpectraLink Voice Priority (SVP) protocol, discussed in several earlier newsletters, for scheduling.

Both SpectraLink and the WLAN systems makers agree that voice VLANs are important for security. The reason is that device authentication mechanisms for phones haven’t caught up with those for other devices.

“MAC authentication is about the only way to figure out whether a phone is authenticated to a network now,” says Andris Dindzans, director of product management at Trapeze.  “It’s primitive. If phones are put on one VLAN, you can put strong access-control filters on that VLAN.”

For example, a VLAN could be restricted to accessing just a voice server and barred from accessing data servers and the Internet, he explains.