How to configure LAN and VoiceVLAN on Palo Alto Firewall when an IP Phone is directly connected.

• Phone connected to the firewall.
• Port status shows up (green on GUI) and full duplex.
• Phone not getting DHCP or even using static IP does not reaching the interface IP.
• Connecting a laptop works perfect.
• Global counters does not point to any drop.
• Packet capture does not show any packet received.

• Palo Alto Firewall
• IP Phones
• PANOS

IP phones have 2 different ports usually:

1. Port for connecting the workstation on the desk.
2. Port for connecting to the patch-panel/wall/switch/firewall.

By default IP phones might expect a voice VLAN to send the voice traffic, however it occurs transparent when using layer 2 switches with VLAN configuration.

Phones forwards the packets received on the desk-port to the port for connecting path-panel/switch/firewall without adding any tag, meaning traffic is delivered to the firewall untagged. (by default all interfaces in PANOS accept untagged traffic)

Hence if a port receives VLAN voice traffic it will be silently dropped since by default this traffic is not accepted due is categorized as "tagged traffic"

Before taking any approach, first we have to be aware about which VLAN ID the phone is using for tagging voice traffic, that can be checked on the local phone network configs, some phones offer Web-GUI local management page or those have a screen to see networks configs. Hence before proceeding first find out which VLAN ID is being used.

To resolve this problem there are multiple approaches we can take depending on the environment

Approach #1 (Recommended)

1. Create separate L3 VLAN interfaces, for example 'LAN' and 'VOICE-LAN'

   2. Create physical port bridging to Voice VLAN, creating a subinterface:

What the above mentioned config does it to accept untagged traffic and forward it to L3 VLAN interface"LAN" in the segment "192.168.22.0/24" AND traffic received with VLAN tag 990 will be forwarded to L3 VLAN interface "VOICE-VLAN" in segment "192.168.23.0/24"

Approach #2

L3 VLAN interface configured with L2 ports referencing this VLAN which makes Firewall ports act as a switch

Create VLAN L3 Interface:

Physical port bridged to VLAN interface:

1. Configure parent interface as L2.
2. Configure a subinterface on the L2 interface and tag it using the VLAN phone is expecting and reference the L3 VLAN on the VLAN drop down, on this example a VLAN named "LAN" is being used:
3.      3.  Commit the changes

Now the firewall should be able to receive and process the packets sent by the phone.

Note: This approach leaves phones and other network devices in the same subnet range and layer 2 domain.

This issue might occur on multiple IP Phones vendors such as Cisco, Grandstream, Yealink, Poly, etc...