Never considered this before, but a customer asked me this.

They have (20) 9608 IP phones on an IP Office. The phones are set to use vlan 2 and their data is on vlan 1.

From their computers, they can ping the IP address of a phone, even though it is in a separate vlan/network. The only way I can think that this is happening, is the WAN (LAN2) port of the IP Office is the DHCP server for the phones and the LAN port is on their data network so that it can be reached using Manager and so it can communicate with the VM Pro server.

In my mind, the IP Office is somehow bridging that connection from the data vlan to the voice vlan. How can I isolate the traffic? Customer thinks that they should be totally separate. Although they have never complained about any phone issues and I haven't noticed any call/voice issues either.

How far apart are the vlan segments?

I guess I'm not sure what you mean by how far apart the VLAN segments are.

VLAN 1 (data) is 192.168.1.xxx
VLAN 2 (voice) is 192.168.2.xxx

If you do a trace route, that will show the IP addresses and VLANS it is hitting...

Update...

Went back to customer today to do this traceroute, and I could no longer ping a phone IP from the computer. I was told that the network guy found something. My guess is something was plugged in wrong somewhere or they had a static route built somewhere that is now gone.

Customer is happy and all is good.

Thank you for the responses and suggestions.

My thought was that the subnet mask was set to 255.255.255.0, which would only allow you to see 255 IPs on the native segment. A mask of 255.255.254.0 would allow traffic from 192.168.1.x to see 192.168.2.x.