{"id":901,"date":"2017-12-02T10:33:19","date_gmt":"2017-12-02T15:33:19","guid":{"rendered":"https:\/\/learncctv.com\/?p=901"},"modified":"2020-09-17T08:02:35","modified_gmt":"2020-09-17T13:02:35","slug":"the-use-of-vlans-in-cctv","status":"publish","type":"post","link":"https:\/\/learncctv.com\/the-use-of-vlans-in-cctv\/","title":{"rendered":"How to setup VLANs for CCTV"},"content":{"rendered":"

VLAN configuration for CCTV is very important to protect the IP cameras against unauthorized access and also to separate the security camera system from other computers and devices that are connected to the IP network.<\/span><\/p>\n

If you have layer 2 <\/span>network switches<\/span><\/a> such as Cisco, Netgear, HP, Dell, Dlink and others, they can be easily configured to be used on your CCTV system.<\/span><\/p>\n

\"VLAN<\/span>[tcb-script type=”text\/javascript”]amzn_assoc_placement = “adunit0”;amzn_assoc_tracking_id = “learn-cctv-20”;amzn_assoc_ad_mode = “search”;amzn_assoc_ad_type = “smart”;amzn_assoc_marketplace = “amazon”;amzn_assoc_region = “US”;amzn_assoc_default_search_phrase = “Cisco switch VLAN”;amzn_assoc_default_category = “All”;amzn_assoc_linkid = “a92a56b924c5dcfdd42cf53ecfdea8b2”;amzn_assoc_title = “Related products”;amzn_assoc_rows = “4”;amzn_assoc_design = “text_links”;[\/tcb-script][tcb-script src=”\/\/z-na.amazon-adsystem.com\/widgets\/onejs?MarketPlace=US”][\/tcb-script]<\/p>\n

In this article, I will discuss the importance of <\/strong>VLANs for CCTV, how the technology works and how to do VLAN configuration for CCTV projects<\/strong>.  <\/span><\/p>\n

Let’s start by learning the VLAN fundamentals<\/strong>, understand how it is used on <\/span>network switches<\/span><\/a> and learn how to setup VLAN for security cameras.<\/span><\/p>\n

What are VLANs<\/h2>\n

VLAN is a technology used to segment networks by creating virtual groups.<\/span><\/p>\n

It stands for Virtual Local Area Network<\/strong> and it is frequently used on network switches to create virtual groups<\/strong> to allow broadcast traffic control and also to increase the security access level thus avoiding unauthorized access.<\/span><\/p>\n

\"Switch<\/span><\/p>\n

On a switch <\/strong>it is possible to create VLANs<\/strong> and associate them to specific switch ports. Devices such as computers and IP cameras that are connected to the same group of ports will be able to communicate in the network. <\/span><\/p>\n

VLAN traffic segregation<\/h2>\n

In a scenario with computers and CCTV cameras connected to the same switch it’s possible to create VLANs <\/strong>to separate the broadcast <\/strong>traffic<\/strong>. <\/span><\/p>\n

The diagram below shows an example of a <\/span>network switch<\/span><\/a> that has IP CCTV cameras and computers connected to its ports. Notice that the VLANs are created and represented by different names, IP address range, and colors.<\/span><\/p>\n

\"VLAN<\/span><\/p>\n

On IT environment network admins use to name VLANs by using numbers and colors. In the the picture above you can see VLAN 10<\/strong><\/span> and VLAN 20<\/span><\/strong> using the blue and green color respectively to represent different groups.<\/span><\/p>\n

VLAN Security<\/h2>\n

VLAN can increase the security in the network by assigning specific switch ports to groups. See the picture below where a man’s laptop is connected to port 1<\/strong> on the Blue VLAN<\/span><\/strong> and communicates with PC2 on port 3.<\/strong> <\/span><\/p>\n

An intruder removes the IP camera from its cable on port 4 to connect his laptop and hack the network. He connects to the Green VLAN<\/span><\/strong> to try to hack the security camera but he can’t have access to the rest of the network.<\/span><\/p>\n

\"VLAN<\/span><\/p>\n

The same principle applies to the company worker, he can’t have access to the  security camera because it’s connected to a different VLAN.<\/span><\/p>\n

How VLAN TAGs work<\/h2>\n

To be able to control the traffic a <\/span>switch <\/span><\/a>uses a TAG which is just a way to mark the frames that enter or leave each port, <\/span><\/p>\n

The frames coming into switch port 1 or 3<\/strong> are tagged as part of VLAN 10<\/strong>, and frames coming into port 2 or 4<\/strong>  are tagged as part of VLAN 20<\/strong>.<\/span><\/p>\n

The TAG can be different depending on the switch brand, however there’s a universal TAG standard called 802.1Q<\/strong> that is used by most manufacturers.<\/span><\/p>\n

See the picture below. When the frames come from the IP camera to the switch they are tagged, Those tags are removed before leave the switch.<\/span><\/p>\n

\"How<\/span><\/p>\n

See below the tags fields according to the universal 802.1Q standard. <\/span><\/p>\n

SOURCE:<\/strong> Package SourceDESTINATION:<\/strong> Package DestinationTYPE & LEN:<\/strong> Type and sizeDATA:<\/strong> The data contained in the packageFRAME CHECK: <\/strong>Frame check<\/span><\/p>\n

See the illustration of the TAG that is associated with the frame<\/span><\/p>\n

\"802.1<\/span><\/p>\n

Communication between switches<\/h2>\n

When connecting two switches it is necessary to use a special port called “Trunk<\/em><\/strong> Port<\/em><\/strong>” or “Tagged Port<\/strong><\/em>” that will allow the traffic of all the VLANs to pass. So the frames with the 802.1Q TAGs<\/strong> will pass through this port.<\/span><\/p>\n

Some manufacturers have a slightly difference VLAN ports nomenclature. On Cisco switches documentation the term “Trunk<\/em><\/strong> Port<\/em><\/strong>” is used for those special ports. Other manufacturers such as Netgear, HP and Dell use the term “Tagged Port<\/strong><\/em>” but in any case all of them use 802.1Q TAGs.<\/strong><\/span><\/p>\n

\"Vlan<\/span><\/p>\n

Now the IP security cameras and the computers can send traffic from the first to the second switch and still keep the broadcast and security under control.<\/span><\/p>\n

The first switch can tag the frames that come from the security camera and move them through the trunk (tagged ports) to the second switch.<\/em><\/strong><\/span><\/p>\n

Type of switches for VLAN configuration<\/h2>\n

For VLAN configuration is necessary to use layer 2 manageable switches<\/strong>.<\/span><\/p>\n

Each manufacturer has a different way to create and manage <\/strong> VLANs by using CLI<\/strong> (command line interface) or Web Interface<\/strong>. But in any case the setup is pretty similar and it’s very easy to create and configure VLANs.<\/span><\/p>\n

Example of VLAN configuration for CCTV <\/h2>\n

Let’s take a look at a CCTV camera system with 4 Desktops that use the VLAN 10<\/span><\/strong> and 3 IP cameras and 1 NVR using the VLAN 20.<\/strong><\/span><\/span><\/p>\n

On this small CCTV project, the VLAN separates the corporate broadcast network traffic from the IP camera broadcast network traffic. See the diagram.<\/span><\/p>\n

\"CCTV<\/span><\/p>\n

On this CCTV VLAN configuration the desktop users will not be able to have access to the IP cameras or NVR. So your security system is protected. <\/span><\/p>\n

So, as you can see VLAN<\/span> configuration for CCTV is very important to keep your system safe from hackers and intruders.<\/span><\/p>\n

Creating VLANs on a cisco switch<\/h2>\n

As a quick example, let’s see a VLAN configuration on a 8 port Cisco switch. The model is Catalyst 2960 PD that will be configured using the CLI:<\/span><\/p>\n