Dividing the network into multiple VLANs does not provide any benefit if the traffic between the VLANs is not restricted. However, the Messaging VLAN must communicate with the IP telephone and media gateway VLANs using signaling protocols to setup and authorize calls. The IP telephone VLANs must exchange media traffic with the gateway VLANs and with the server VLAN if voicemail applications run on the servers. The Messaging Server and phone VLANs also share administrative protocols so that the Messaging Server can configure IP telephones. These may be different protocols than those used by the administrative VLAN. And the Messaging Server VLAN might provide network services, such as NTP, which might be used by most devices on the Messaging network.
Traffic between IP telephony VLANs can be controlled by packet filtering routers or Layer 3 switches. The access control lists (ACLs) on these devices must be configured to only allow IP phones to connect to the Messaging Server the phone needs to function and vise versa. In many cases, this means that only VoIP signaling protocols need to be allowed between telephones and the Messaging server. Filtering should be done based on IP address, port number, and TCP/IP flags, not port number alone.
The Messaging and data VLANs are usually separated by stateful Layer 3 & 4 traffic filtering configured to block most protocols but to allow passage of those protocols required for IP telephony features.
As much as possible, traffic between the Messaging Server and the data network should be minimized. For example, the customer should disable the Web interface on the IP telephones, and allow users to manage the phone on a central server that would securely push changes to the phone. To further manage traffic between the Messaging VLANs and the data VLANs, the customer can use the Messaging Firewall to eliminate some types of traffic between the Messaging network VLANs and the data VLANs. However, router firewalls might be used to provide more extensive firewall protection between VLANs.