Description

The MAC address of the IP Phones is being learnt on the data VLAN instead of voice VLAN.

Symptoms

For Juniper Networks EX/QFX Series switches, by default, when LLDP is configured without the voip-mac-exclusive feature, a client MAC address is unrestricted and can be learnt on both VOIP VLAN and data VLAN. It is possible that a phone's MAC is learnt in both data and VOIP VLAN and the phone is sending LLDP frames, DHCP, BOOTP packets in data VLAN.

A mac once learnt on a VOIP VLAN will not be learnt on data VLAN until the mac ages out in the VOIP VLAN. If a mac address has been learnt first on a data VLAN and then later on a VOIP VLAN, then the mac address will be flushed from the data VLAN and learnt only on the VOIP VLAN.

 

Solution

When voip-mac-exclusive is enabled on an interface, the MAC will be removed from data VLAN if the MAC is learnt on the VOIP VLAN. 
https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/ref/statement/voip-mac-exclusive-edit-ethernet-switching-options-secure-access-port.html

 

Modification History

6/6/2023 - Creation Date
11/22/2023 - Minor edit

Related Information

https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/ref/statement/voip-mac-exclusive-edit-ethernet-switching-options-secure-access-port.html