How many phones per vlan/subnet?

[HendersonD]

We are putting in a new Mitel phone system over the next six months. We are a K-12 school district with a single 190 acre campus. Each of our buildings are connected with underground fiber so we really have a single LAN. Our network is a hub and spoke design with a stack of Juniper EX4600 switches at the core providing layer2/3 and Juniper EX4200s at the edge. Our vlans are in a 1:1 relationship with our subnets. We will have about 600 Mitel phones with a mix of 3 models, 6920, 6930, and 6940. A Mitel 3300 series controller is also being installed.

I know I need to have separate vlans for voice and data. The question becomes should I have a single voice vlan/subnet that spans all of campus or several vlans/subnets, perhaps one per building, for voice traffic? Typically the reason for dividing up traffic is to limit broadcast traffic and allow the implementation of QoS. Not sure if Mitel phones generate a lot of broadcast traffic. If we go with a single vlan/subnet then QoS rules are all applied at layer 2. If we go with multiple vlans/subnets then we also have to apply QoS rules at layer 3. All routing on our network is done at the Juniper EX4600 core, none at the edge. All ethernet connections to phones are 1 gig with most phones being daisy chained to printers or desktops.

[johnp]

You sould need only the one vlan for voice, you may have to mask the voice network to provide for the amount of phones. You have a typical school setup, with the fiber connecting locations.

[HendersonD]

We have a class A address space so I could use 10.121.56.0/22 vlan/subnet and that should work. Even if I reserve 30 IP addresses for assigning statically, that still leaves nearly 1,000 addresses I can hand out via DHCP to phones.

So we will not run into any issues with excess broadcast traffic or quality of voice calls with 600 phones in the same vlan/subnet? I believe we will be using LLDP-MED so the phone and either desktop computer or printer daisy chained to the phone get the proper IP address and end up in the proper vlan/subnet.

The only other worry with a single vlan/subnet for all phones is could one or two bad phones flood this subnet with excess traffic and cause a problem?

[acejavelin]

600 phones, in different buildings... My question would be are their distinct subnet/VLANs now, say for certain buildings? Then just I would make unique voice subnets/VLANs to match the data subnets.

My issue with having them all 600 in a single subnet wouldn't isn't with voice quality, but if someone does something stupid, like plug the PC port of a phone back into the wall thus looping the voice and data VLANs together, with a large campus environment it could be difficult to troubleshoot, but if the issue only effected one building it would be much easier.

Of course, without know more about your network layout it is tough to make a solid recommendation.

[VinceWhirlwind]

600 phones, in different buildings... My question would be are their distinct subnet/VLANs now, say for certain buildings? Then just I would make unique voice subnets/VLANs to match the data subnets.

^^ This - I create Voice VLANs as direct pairs for the Data VLANs.
It really isn't about limiting broadcast segments, it's just about creating easy-to-manage networks.
 
I start with a 10.0.0.0/8 and divide it up geographically into Campus/Building/Floor giving each subnet a /24 for ease of management. I make the distinction between Data and Voice in the least significant octet, so something like:
10.1.10.0/24 is my Data, 10.1.20.0/24 is my Voice.
That way you know where a device is just by looking at its IP address, and changes or outages can be made to affect a single segment at a time.
 
I once saw a very large multi-campus university who had used the most significant octet to differentiate by subnet function (instead of geography) - as a result their routing table was larger than their routers' capacity. Very poor design, that one.

[HendersonD]

We have 5 academic buildings on campus and a bus garage/maintenance building. We have separate vlans/subnets per building for wired devices (desktop computers and printers). We also separate vlans per building for district owned wireless devices (laptops and Chromebooks). We have a single district wide vlan for personal wireless devices, primarily phones.

We have separate vlans for infrastructure items like servers, storage, ESXi hosts, video cameras, HVAC equipment, vMotion, and Lighting. We are leaning towards one single vlan for phones to follow the KISS principle (keep it simple). Is there a good reason to put in 6 separate vlans for phones, one per building? It is certainly easier to apply QoS rules with a single vlan.

[VinceWhirlwind]

As a general rule, a VLAN should span as few switches as possible (ideally each VLAN is only present on one uplink from the Core/Distribution, and its redundant pair), so from a design perspective a VLAN that spans an entire campus isn't particularly desirable from the point of view of risk management in terms of both faults and simplicity of management.
 
As far as simplicity goes, I find matched pairs of Data/Voice VLANs is effective.
 
As for QoS, it depends on the requirements as well as the vendor implementation, but if you're simply "Trust"ing the Layer2/Layer3 markings it doesn't really matter how many VLANs you have - each Access switch should only have one Voice VLAN anyway.
If you're having to re-mark the voice traffic, that's done on ingress at the Access level anyway, so you would have the exact same config on every single Access switch regardless of which VLAN it's in, possibly identifying by a different subnet on each Access switch (if that's how your QoS policy finds the relevant traffic).
 
Multiple VLANs means creating multiple DHCP scopes. Some people might see this as extra work, but managing a bunch of small scopes provides an on-going advantage over managing one single larger scope.

[ZuluAlpha]

Multiple VLANs means creating multiple DHCP scopes. Some people might see this as extra work, but managing a bunch of small scopes provides an on-going advantage over managing one single larger scope.

I will personally vouch for that. It's work setting the scopes up, but generally you only have to do that once and once it's done it really helps hone in on issues.

[Dogbreath]

I know it's a bit tiresome to see "+1"s in a forum thread, but yeah, have to agree with the other posters here. It's more work up front segmenting things  but it will save you much time later.
Fully working LLDP is also a lifesaver.

[lundah]

I would set up a separate voice VLAN & subnet for each building. Makes management much easier, as you can look at the IP of a phone in the MiVB maintenance screens and know exactly which building it's in without having to look it up in Telephone Directory or an inventory management system. You also can then use the subnet to set building-specific properties based on the Zone ID, like the outgoing CPN and CESID information.

[HendersonD]

Thanks to everyone for their input. We will be creating separate voice vlans for the 6 buildings on our campus.