Monitor network VLAN division and address planning

Why we need independent networking

• Security: Once the monitoring equipment is connected to the office network, it may become an entry point for network attacks; conversely, viruses and broadcasts on the office network will also affect monitoring.
• Stability: Video streaming takes up a lot of bandwidth and will affect each other when mixed with the business network.
• Manageability: Independent network segments facilitate fault location, traffic statistics, and access control.
• Compliance: Some industries require physical or logical isolation of security system networks.

VLAN planning suggestions

IP address planning

• Segmented by area or floor: For example, 10.10.10.1–.50 is Building 1, .51–.100 is Building 2, Facilitates direct location location via IP.
• Reserve expansion space: Reserve at least 30% of the addresses for each segment.
• Use a fixed IP for the camera: Do not use DHCP to avoid address changes causing the NVR to go offline.
• Unified Gateway: Usually located on the core switch.
• Create an address account: IP ↔ point ↔ MAC ↔ switch port corresponds one to one.

Switch port planning

• Access layer switches are deployed by region, and the uplink must meet the aggregation bandwidth (multi-port Gigabit uplink or 10 Gigabit).
• Reserve 10% to 20% spare ports for each switch.
• Enable port isolation or private VLAN to prevent cameras from accessing each other.
• Enable Storm Suppression and Loop Detection.
• Critical links are link aggregation or ring network redundant.

Bandwidth accounting

1. Access switch: Uplink bandwidth ≥ the sum of the bit rates of all cameras under the switch × 1.2.
2. Core switch: Upstream bandwidth ≥ cross-VLAN/cross-region access traffic.
3. Important note: Playback, wall posting, and client multi-screen preview will generate additional traffic.

Common security measures

• Different VLANs are controlled through ACL, and only necessary ports are opened.
• Close unnecessary services on the device (Telnet, HTTP management port, etc.).
• Modify the default account password and disable the default account.
• Update firmware regularly.