VLANs for Video Surveillance Tutorial

Author: John Scanlan, Published on Sep 26, 2016

Many people confidently say to 'use VLANs' as an answer to IP video networking problems and as a way to signal expertise.

But how should VLANs be used? What benefits do they really deliver or not?

vlan

In the note, we examine:

  • Segmentation of applications across VLANs
  • Untagged vs tagged VLANs
  • Static vs dynamic VLANs
  • VLANs for uplinks
  • Bandwidth and VLANs
  • QoS and VLANs
  • Common applications of VLANs

**** ****** *********** *** to '*** *****' ** an ****** ** ** video ********** ******** *** as * *** ** signal *********.

*** *** ****** ***** be ****? **** ******** do **** ****** ******* or ***?

vlan

** *** ****, ** examine:

  • ************ ** ************ ****** VLANs
  • ******** ** ****** *****
  • ****** ** ******* *****
  • ***** *** *******
  • ********* *** *****
  • *** *** *****
  • ****** ************ ** *****

[***************]

********

***** (******* ***** **** Network)********* ******* * ****** physical ****** ** ******** into ******** ******** ******* networks, ****** ******* ** one **** "*********" ** and ****** ** *********** with ******* ** ******* unless **** *** ****** together.

*** ******* ** ******* shows ***** ** * typical ****** / ********* network. ** **** ********, surveillance ******* ** ********* from ******* ****** *** VOIP ******* *** ***** separate *****. *** **** devices **** *** *********** with **** ***** ** the ************ ***** *** the ****** *** *** NVR, ** **** *** in *** **** ****.

Untagged **. ****** *****

***** *** *** *********** types ** *****, ****** and ********:

******** *****

** *******, *** ***** of * ****** *** added ** * ******* untagged **** (********* **** ID *), ******* **** all ***** *** "***" all ******. ****** ******** ports ** ******* **** ID ** ******** ********** this *******.

*** ******* ******** ***** is ******* *************, ** no ******** ****** ************* (cameras, *******, ***.) **** be *********, ** ******* is ****** ******* ** the **** ** *** switch. *******, ***** (********* uplinks) *** **** ** assigned ** * ****** untagged ****. ** ** a ******** ****** **** see ******** *****, **** as ****** **** ********/********, surveillance, *** ****, ***** must ****** *** ******* (below) ** ***** *** two **** ******** ********, both ** ***** *** complexity.

****** *****

***** *** **** ** tagged **** ******** **** IDs ***** ***.** *******. Traffic ******** *** ******* the **** ** ****** with * ******** ** which ** ********* ** the ********* ******.

*** ******* ** ****** VLANs ** **** ***** may ** ******** ** more **** *** ****, unlike ********. *******, *** devices ********* ** ***** ports **** **** ******* 802.1Q, ***** ** *** supported ** **** ** cameras ** ***** ******** devices, *** ******** ********** Windows ********** ** ** installed/configured ** ***. ******* of ****, ****** ***** are ********* **** **** for ******.

Static *****

**** ***** ************ ******** use ****** ***** ********** per ****. *** *******, ports *-** ** * switch *** ** **** of *** ******* ***, while **-** *** **** of *** ****** ****.

**** ***** ****** ***** are **** ******, *** simplest ** *** **, but **** ** ******** reconfigured ** ******* *** moved ** *****, ****** dynamic *****. ** *** video ***** ** ******* a ******** ** *********** port ***** *****:

Dynamic *****

******* ***** ****** * port ***** ** *** MAC *******, ***********, ** type ** ******. **** provides ******* ***********, ***** devices *** ** ******* into *** ****, *** rearranged ** ******.

*******, ******* ***** ** dynamic ***** **** ****-*********, as *** ******** ** macros **** *** ****** identifiers ** ***** **** be *******, ****** **** less ******** ****, ********** in ************ ** *******, servers, *** ***** ********* typically ******* ********* ** the **** ****, *** are *** *****.

*** ***** **** *******

***** *** * *** variations ** ******* *****. Below ** ******* ** image **** * ******* switch **** ***** *** based **** *************. *** switch **** ******** *** MAC ******* ** *** device ********** ** ** and **** *** ** to *** *********** **** based ** *** ********** policy.

***** ******* **** *******

******* ***** *** **** set *** *** ***** means, ******* ** ***** is ****** ** ************:

  • ******/"***** *****": **** ****** uses ********* **** ** CDP/LLDP ** ************* ***** the ****** **** ********* and ****** ** ** a ****. **** ** commonly **** ** ***** over ** *** ******* network ********, *** *** vast ******** ** ** cameras ** *** ******* the ******** *********, ****** it *********** ******* ** surveillance.
  • ****** *********/****: *******, ******* which ******* ****** *********/**** may ** ******** ** a ******** ***** ** coordination **** *** ****** controller. *** ******* ******* these *********, *** ** may ** ****** ** assigning ******** ***** (******, security ********, ******, ***.) rights ** **** ************ devices, ********** ** ***** machine **** *** ** from.

VLANs *** *******

***** *** *** **** to ****** ***** ** switch ****** *****.

  • ********* **** *** ****:** ******** **** ******** uplink ***** *** *** VLANs, ******** ****** ***** may ** ******** ** a ****** ****. **** is *** ******** ****** to ***, ****** *** number ** ***** **** be ***** **** *** number ** ****** *****.
  • ****** ***** ****:******, ******* *** ** sent **** * ****** uplink **** ** *****, referred ** ** * trunk ****. ******* ******* trunk ***** ** ****** as ******** ***** ***** 802.1q (*** *****). **** method ** ******** **** complex, *** ********* ********* as ** ****** *** link *********** *** ******** and/or ****** ****** **********.

VLAN ********

********* ******** ** ****** networks ** *** **** benefit ** ***** *****. By ********** ******* **** multiple ******* ****, ************ may ******** ******* ** the **** ****** ** general **** ** ***** traffic. *** ********* ********, the ******** *** ********* to **** ***** ** clients ** *** ****** LAN *** *** ***** the ************ ****.

********* *****

** ************, ***** *** not **** ** **** bandwidth, * ******* ****. It ** *********** **** that ***** ****** *** amount ** ******* ** the ***, ***** ********** are *** **** ** the ****** ******** *******, but **** ** *** originating ****. *******, **** generally **** ******* *********** on **** ***** ********, with ******** ** *******. In * **-****** ***, they **** **** ****** to ** ******. ** your ************ ******* ******** your ** *******, ***** traffic ** ***** ******** will ** ********.

VLANs *** ***

*** ** *** ******* VLANs *** ***** **** as *********** ** ********** bandwidth ** ******* **** are ***** **** ** conjunction **** ******* ** service. *** *** ** set ** **** ** most ******* ********. * surveillance ****, *** *******, may ******* ****** ******** as * ***** **** general **** ** ***** VLANs.

Equipment ************

************ ***** ******** ******* switches ** ****, ** unmanaged ******** ***** ** configuration **********. *** **** majority ** ******* ******** (both *****-******* *** ***** switches) ********* ***** *** VLAN-capable. ***** *** *** our****** *************** *** ************ systems*** **** ***********.

VLAN ********* *** ************

*** ***** *** ******* varies, ********* ** *** application:

  • ***** *******:** *** ****** ***** systems, **** ** ***** retail, ***** *** ********* not **** ** ***-**** unmanaged ******** ******* **** support *** **** ***** deployed. ****, ******* ** normally ********* ** *** same ******** ** ******* office *****, ** ******** VLANs ***** ******* ******* be *** **, ****** cost.
  • ********* *******:**** ******* * *** with ***** ********, ***** the **** ** ******* and ***** ** ***-***** offices, ***** *** ******** implemented. ** ** *** uncommon *** ***** ********** to *** *** **** for ****, *** *** VOIP *******, *** *** for ********, ** ****** segment ***** ********. ******* between *** ******* ****** VLAN *** ******** **** is ******** ********, ** give ****** ******* ****** to *****.
  • ********* ******* ******* *****:**** ***** * *********, separate ****** *******, ***** are ***** *** ****** or *******. ** ****** from *** ******* *** is ******, *** *** separate ******** ******** *** connected *** ******.
  • ********* ******* **** *****:** ***** *******, ******** VLANs *** ** ****, even **** ***** * dedicated ******** *******. ******* and ******* *** ****** on ******** *****, ** prevent *** ********* ********* by ***** ** ********** stations ******** ****** *** cameras' *** **********. **** access ******* ** ******** on *** *******, ** well, **** ************* ********* using * ******** ****, as ****** ******* *** create ********* ******* ***** may ****** ****** ** the ************ ******.

***********

***** *** ***** ** VLANs ** ************* ******** by ****, **** ** have **** ********** ** shared ****, ********** ************ access ** *****. *******, VLANs *** *** * panacea ** ******* ********, and ****** ** ******** only **** *********. ******** a ***** ********* ******* demands **** ************* *** coordination, *** ****** *****.

**** **** *********

**** ***** ******** *******

Comments (11)

Great info!

It would be interesting if you could cover Avaya's Fabric Connect networking technology that can help speed network implementation which have a large number of network cameras. (P.S. my current company is also an Avaya Platinum partner)

Thanks, John. One question about:

One of the reasons VLANs are often seen as restricting or allocating bandwidth is because they are often used in conjunction with quality of service. QoS may be set by VLAN in most managed switches. A surveillance VLAN, for example, may receive higher priority as a whole than general data or voice VLANs.

If the surveillance VLAN consists of a static group of ports on a non-blocking switch, how would having a higher priority improve its performance over the voice VLAN, also with its own discrete non-blocking ports?

Great question and also the most common argument for not implementing QoS.

Congestion, (#2). If you do check out this link please keep in mind (not mentioned in the linked article) that we will have other devices connected to the switch, devices that possibly consume much more bandwidth /resources than IP cameras. There may also be access or distribution switches connected to distribution or core switches, and the network congestion will be exacerbated by the aggregate traffic from the devices connected to those feeder switches. At some point our network will experience data burst / congestion / etc & we want to decide how traffic is handled.

How would this work for PCI compliance?

I've installed POS equipment and networking equipment for several of the largest retailers and they all used VLANs to separate their POS equipment. All of them had specific ports that the POS equipment needed to be connected to.

Thanks John

What about VLAN Hopping? Would that not be a security concern for those larger retailers?

Yes, and while I was not hardening the equipment for these retailers I can only guess that they implement security best practices to help mitigate double tagging & switch spoofing.

Great article and surely will help move the needle forward for the industry. The more our industry understands network security, the better.

how do we route two VLANs together to allow certain individuals on other
VLANs access to the surveillance network

It depends on the switches and routers in the network. Layer 3 switches can route between VLANs, or if using layer 2 switches, the router will route all interVLAN traffic. Depending on the brand and capabilities of the equipment, you can grant access between VLANs via firewall rules or ACLs.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

H.265 Usage Statistics on Apr 19, 2019
H.265 has been available in IP cameras for more than 5 years and, in the past few years, the number of manufacturers supporting this codec has...
Access Control Course Spring 2019 - Last Chance on Apr 19, 2019
Register for the Spring Access Control Course. IPVM offers the most comprehensive access control course in the industry. Unlike manufacturer...
Door Operators Access Control Tutorial on Apr 17, 2019
Doors equipped with door operators, specialty devices that automate opening and closing, tend to be quite complex. The mechanisms needed to...
Pole Mount Camera Installation Guide on Apr 11, 2019
Poles are a popular but challenging choice for deploying surveillance cameras outdoors. Poles are indispensable for putting cameras at the right...
Spring 2019 IP Networking Course- Register Now on Apr 04, 2019
Register now for the Spring 2019 IP Networking course here. Just $299 for the course. This is the only networking course designed specifically...
Casino Security Consultant Carl Lindgren Interview on Mar 26, 2019
For more than 20 years, Carl Lindgren worked as a casino surveillance pro, while being active (and sometimes outspoken) on various online video...
Installation Course - REGISTRATION CLOSED on Mar 14, 2019
This is the last chance to register for the March Installation course. CLOSED This is a unique installation course in a market where little...
Ubiquiti Favorability Results 2019 on Feb 18, 2019
Ubiquiti has quietly grown into a $1+ billion annual revenue company, with offerings across wireless, wireline network and video surveillance (see...
Bandwidth vs Low Light Shootout - Avigilon, Axis, Bosch, Dahua, Geovision, Hanwha, Hikvision, Uniview, Vivotek on Feb 08, 2019
Nighttime bandwidth spikes are a major concern in video surveillance, but do all manufacturers' cameras perform the same? Are some more consistent...
ONVIF Video Surveillance Tutorial on Jan 29, 2019
ONVIF is well known within the surveillance industry as an interface to connect IP cameras and VMS systems. However, new users may find it...

Most Recent Industry Reports

H.265 Usage Statistics on Apr 19, 2019
H.265 has been available in IP cameras for more than 5 years and, in the past few years, the number of manufacturers supporting this codec has...
ACRE Acquires RS2, Explains Acquisition Strategy on Apr 19, 2019
ACRE continues to buy, now acquiring RS2, just 5 months after buying Open Options. One is a small access control manufacturer from Texas, the...
Access Control Course Spring 2019 - Last Chance on Apr 19, 2019
Register for the Spring Access Control Course. IPVM offers the most comprehensive access control course in the industry. Unlike manufacturer...
Riser vs Plenum Cabling Explained on Apr 18, 2019
You could be spending twice as much for cable as you need. The difference between 'plenum' rated cable and 'riser' rated cable is subtle, but the...
Verint Victimized By Ransomware on Apr 18, 2019
Verint, which is best known in the physical security industry for video surveillance but has built a sizeable cybersecurity business as well, was...
Milestone Drops IFSEC on Apr 18, 2019
Milestone has dropped out of Europe's largest annual security trade show (IFSEC 2019), telling IPVM that they "have found that IFSEC in EMEA no...
The Fastest Growing Video Surveillance Sales Organization Ever - Verkada on Apr 17, 2019
Verkada has the fastest growing video surveillance sales organization ever. In less than 2 years, they already have more salespeople in the US...
Door Operators Access Control Tutorial on Apr 17, 2019
Doors equipped with door operators, specialty devices that automate opening and closing, tend to be quite complex. The mechanisms needed to...
Securadyne CEO: IPVM 'Entertaining For An Ignorant Few' on Apr 16, 2019
Securadyne's CEO Carey Boethel is unhappy with IPVM's report - Failed Integrator Rollup, Securadyne Sells to Guard Giant Allied. Indeed, he...
Dahua Repositionable IR Multi-Imager Camera Tested on Apr 16, 2019
Dahua has released their first repositionable multi-imager camera, the Multi-Flex 4x2MP, claiming integrated IR, true WDR, and flexible...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact