During the process of migrating to new DHCP servers my colleague noticed a lot of inactive leases in the DHCP scope for our data subnets. After cross referencing MAC addresses it became apparent that the leases belonged to our Shoretel IP phones. All of the phones also have active leases in the VoIP DHCP Scope.
First of all we took a look at the DHCP scope options. Option 156 was enabled on both scopes, containing the following.
ftpservers=192.168.***.***,country=7,language=4,layer2tagging=1,vlanid=200
We decided to break out trusty Wireshark to try and figure out what was going on. From here we could see what was going on. When the phones were booting up they were doing the following:
- Trying LLDP
- Requesting DHCP lease from the untagged vlan on the switchport they were plugged into (data subnet)
- Retrieving option 156 from the data scope and reconfiguring themselves to tag voice traffic with vlanid.
- Requesting DHCP lease from the tagged vlan on the switchport they were plugged into (voice vlan)
- Continuing normal boot.
Step 2 is where the phones were getting the lease in the data subnet.
We decided to try lldp-med on the Cisco 2960S switches that we use for access.
This is probably a good time to mention that all of this was tested thoroughly in a controlled environment before it was rolled out to end users. We are not responsible if you break your phone system after reading about our investigations here.
conf terminal
!
lldp-run
!
interface range Gi1/0/1-48
switchport mode access
switchport access vlan 100
switchport voice vlan 200
I won’t go into detail about the QoS config we are running. It is there though, just not shown here.
Next we removed option 156 from the data scope and changed the string in option 156 on the voice scope to the following.
ftpservers=192.168.***.***
After rebooting the phones they did the following.
- Negotiated LLDP with the switch.
- Requested DHCP lease from the tagged vlan on the switchport they were plugged into (voice vlan)
- Retrieved option 156 from the voice scope and reconfigured themselves NOT to tag voice traffic.
- Requested DHCP lease from the untagged vlan on the switchport they were plugged into (data subnet)
- Used a cached config file and continued booting.
Strange. We did some more tinkering and found that if we added the layer2tagging=1,vlanid=200 options back to the option 156 string and rebooted the phone they stayed in the correct vlan. From this we took an educated guess that the phones were assuming the defaults of layer2tagging=0,vlanid=0 if the option were not specified in the option 156 string.
Next we removed option 156 from the voice scope and added option 66, which it a Boot Server Address, and set it to the ftpservers address from the option 156 string, 192.168.***.***.
We rebooted the phones and they did the following.
- Negotiated LLDP with the switch.
- Requested DHCP lease from the tagged vlan on the switchport they were plugged into (voice vlan)
- Retrieved option 66 from the voice scope.
- Contacted the FTP server.
- Continued booting normally.
Success! Or so we thought. The country and language of the phones had both reverted to 1 and 1, meaning the dial tone was different, although the language was still English.
To get around this we changed the config files for the phones on the FTP server. The files were stored in c:inetpubftproot on the Shoreware Director server. The file names are shore_model.txt, where model is referred to on the white label on the back of every model. The original config file looked like this.
There is an updated method to accomplish this, whcih you can find in my newwer post ShoreTel LLDP Followup.

We changed it to the following.

After a quick reboot the phones were back to their normal selves.