Zyxel GS 1900 <-> UDM-PRO Voice VLAN Problem

jst68
jst68 Posts: 7
First Comment
in Switch

I have connected a Yealink T46S to port 8 of my 1900-8 switch. It seems to get an IP address using DHCP, but the phone cannot connect to its server.

I have read quite a few posts before posting here and believe my configuration should be fine.

Port1 is connected to the UDM-PRO and port 8 is connected to the YealinkT46-S. All other ports are connected to desktop, laptops and printers.

Here are some screenshots of my VLAN configuration.

image.png
image.png
image.png
image.png
image.png
image.png
image.png
image.png
image.png
image.png

I hope I have captured all relevant information. The UDM-PRO shows me that the phone has an IP in the voice VLAN subnet and I can connect to its admin interface using that IP. It just seems to block any data going to the phone server.

If my switch configuration is fine, I will open a question with Ubiquiti to determine if there is anything blocking my data, but data seems to cross to other subnets just fine.

Best Answers

  • Zyxel_Kay
    Zyxel_Kay Posts: 1,262  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - WLAN Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security
    Answer ✓

    Hi @jst68

    Your switch GS1900-8's configuration appears to be correct, and we replicated your setup using the Zyxel Firewall USG FLEX 100, Switch GS1900-8, and a Yealink IP Phone T19-E2 for testing.

    Based on our test, the IP Phone successfully obtained a VLAN10 DHCP IP from the DHCP server. Additionally, we conducted a PING test from the server to the IP Phone, confirming that traffic between the two devices is indeed being forwarded as expected.

    Regarding the switch, we were able to verify that the IP Phone's MAC address appears in the switch's MAC table, specifically in VLAN10. This indicates that the switch is indeed receiving traffic from the IP Phone.
    You can check this information by navigating to the switch's local web GUI > Monitor > MAC Table to confirm whether your IP Phone is listed in the Switch MAC table.

    image.png

    If further assistance is needed, you may want to reach out to Yealink or Unifi support for more specific insights.

    Kay

  • jst68
    jst68 Posts: 7
    First Comment
    Answer ✓

    Nevermind. A nice person on Discord helped me doing a tcpdump and then I figured that traffic got blocked by an outdated IPSec tunnel.

    The problem is finally solved! :)

All Replies

  • Zyxel_Kay
    Zyxel_Kay Posts: 1,262  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - WLAN Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security

    Hi @jst68

    To resolve the issue with your Yealink T46S phone not connecting to its server, it's important to ensure that your VLAN configuration is correctly set up. Based on the information you've provided and your switch configuration, it seems like you're on the right track.

    Here's a revised configuration recommendation for VLAN10:

    • Port 1: Tagged
      image.png

    By setting Port 1 as tagged, you allow traffic from VLAN10 to pass through it, which is essential for the phone to connect to the server.

    Feel free to reach us if there is any question.

    Kay

  • jst68
    jst68 Posts: 7
    First Comment

    Thank you for your response @Zyxel_Kay!

    Unfortunately, this did not solve the problem. I mean I understand that this is a complex problem since it involves hardware from multiple vendors.

    Any other suggestions?

  • Zyxel_Kay
    Zyxel_Kay Posts: 1,262  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - WLAN Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security

    Hi @jst68

    To assist you further, could you please share with us your IP phone's configuration?

    Kay

  • jst68
    jst68 Posts: 7
    First Comment

    I can share that tomorrow, but I am basically using auto provisioning

  • Zyxel_Kay
    Zyxel_Kay Posts: 1,262  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - WLAN Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security
    edited September 2023

    Hi @jst68

    You may find the IP phone’s configuration by accessing its local web GUI. If possible, please share with following information:

    1. The screenshots of “Status” and “Network > Advanced” interfaces on IP Phone’s web GUI.
      image.png
    2. It would be helpful if you could provide a network topology diagram. Please indicate where the IP phone's server is connected in relation to the switch and other network devices.

    Thank you for your cooperation.

    Kay

  • jst68
    jst68 Posts: 7
    First Comment
    edited September 2023

    For 1.

    image.png
    image.png
    image.png

    For 2.

    The phone server is remote (cloud based) and so it doesn't show on the network topology diagram I can generate in the UDM PRO UI. I also didn't include it because many labels use descriptions that could potentially endanger my network to attacks.

    Additional information:

    • I am also running another SIP phone (Yealink W60B) on the same VLAN and it works fine, but it is directly connected to the UDM PRO; I am assuming that means that the DHCP/VLAN network is working, right?

    My DHCP server for the voice VLAN.

    image.png
    image.png
    image.png

    As you can see "Isolation" is turned off. If enabled, it isolates the VLAN by disabling traffic to other subnets.

  • Zyxel_Kay
    Zyxel_Kay Posts: 1,262  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - WLAN Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security
    Answer ✓

    Hi @jst68

    Your switch GS1900-8's configuration appears to be correct, and we replicated your setup using the Zyxel Firewall USG FLEX 100, Switch GS1900-8, and a Yealink IP Phone T19-E2 for testing.

    Based on our test, the IP Phone successfully obtained a VLAN10 DHCP IP from the DHCP server. Additionally, we conducted a PING test from the server to the IP Phone, confirming that traffic between the two devices is indeed being forwarded as expected.

    Regarding the switch, we were able to verify that the IP Phone's MAC address appears in the switch's MAC table, specifically in VLAN10. This indicates that the switch is indeed receiving traffic from the IP Phone.
    You can check this information by navigating to the switch's local web GUI > Monitor > MAC Table to confirm whether your IP Phone is listed in the Switch MAC table.

    image.png

    If further assistance is needed, you may want to reach out to Yealink or Unifi support for more specific insights.

    Kay

  • jst68
    jst68 Posts: 7
    First Comment

    It is getting an IP address which I can see on the UDM -PRO.

    I can also see the configuration working in a sense that it points the phone to the voice VLAN. hHere is a screenshot showing that.

    image.png

    Y phone is connected to port 8 of the switch.

    I can also see ait in the UDM-PRO, but it fails to connect to the 3cx cloud..

    image.png

    From my point of view, all this shows me that the "blocking" takes place in the UDM-PRO and not the Zyxel switch. As such, I will create a post on the Ubiquiti community to resolve this.

    Thank you for your help!

  • jst68
    jst68 Posts: 7
    First Comment

    Ok. I have worked with Ubiquiti support and they had me plug my switch uplink cable into the phone directly which worked right away. As a result, I couldn't help but agree with them that the issue is likely with the switch. They also took a look at my other configuration, and everything looks good.

    So, what else can I try? It's hard to believe that I am the only person with this problem.

  • jst68
    jst68 Posts: 7
    First Comment
    Answer ✓

    Nevermind. A nice person on Discord helped me doing a tcpdump and then I figured that traffic got blocked by an outdated IPSec tunnel.

    The problem is finally solved! :)

Categories

Switch Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）