VLAN
Virtual LAN
A logical Layer 2 network that separates devices even when they use the same physical switches.
In everyday business: Staff, cameras and guest WiFi can be kept apart without buying a separate switch for each.
IP CCTV INFRASTRUCTURE
IP Camera, PoE Switch and NVR Network Design Playbook
How to design the network around cameras, calculate traffic and storage from real bitrates, and avoid PoE and uplink bottlenecks.
Book 5 | Chapter 2
Chapter opening
Chapter 2 moves from the course overview into ip camera, poe switch and nvr network design. The aim is not to memorise product menus or commands. The reader should understand what problem the technology solves, how it fits into the wider security and cctv technical textbook, what normal operation looks like, and how to prove the result in the field.
The previous chapter introduced security cameras, nvr & kvm infrastructure. This chapter continues the sequence by focusing on ip camera, poe switch and nvr network design playbook, so the reader can connect the architecture to a more specific operational problem.
Learning objectives
- Explain the main purpose of IP Camera, PoE Switch and NVR Network Design in plain language.
- Identify the components that must work together for the service to operate.
- Use evidence to separate a design problem from a configuration or physical fault.
- Describe the business impact of a failure and the evidence required for handover.
Why this matters in a real company
PoE lets the company power devices such as cameras and access points from the network switch. Good design reduces local power supplies and makes UPS protection easier, but power budgets and cabling quality still matter.
PLAIN ENGLISH
Technical terms used in this chapter
You do not need to memorise the jargon first. Understand what each term does and why somebody running a company would care about it.
NAT
Network Address Translation
A router or firewall function that changes IP addressing as traffic crosses a boundary.
In everyday business: Many private office devices can share one public Internet address.
PAT
Port Address Translation
A form of NAT that lets many internal connections share one public address by tracking transport ports.
In everyday business: Hundreds of users can browse the Internet through one public IPv4 address.
PoE
Power over Ethernet
Technology that sends DC power and Ethernet data over the same twisted-pair cable.
In everyday business: A camera or access point can be installed with one network cable instead of a separate power outlet.
NTP
Network Time Protocol
A protocol used to keep system clocks aligned.
In everyday business: Correct timestamps let logs from switches, servers and firewalls be compared during an incident.
KVM
Kernel-based Virtual Machine
Linux kernel virtualization technology that turns Linux into a hypervisor.
In everyday business: A Linux server can run Windows and Linux virtual machines.
VM
Virtual Machine
A software-defined computer running on a hypervisor.
In everyday business: It behaves like a separate server even though it shares physical hardware.
BUSINESS TRANSLATION
What this means outside the server room
This topic affects how reliably staff and systems can communicate. Good network design reduces downtime, makes faults easier to find and keeps departments or services separated where required.
VLAN
What it means: A VLAN creates a separate logical network even when devices share the same physical switches.
In normal business language: Think of one office building with separate departments using the same corridors but different access-controlled areas. Staff, cameras, voice and guests can share the same switching hardware without all being in one open network.
Why the decision matters: Use VLANs to separate traffic for security, performance and easier troubleshooting without buying a separate physical switch for every department.
Hypervisor
What it means: A hypervisor lets one physical server run several isolated virtual machines.
In normal business language: Think of one office building divided into secure independent suites. The building is shared, but each tenant operates separately.
Why the decision matters: Virtualization reduces hardware sprawl and improves flexibility, but the physical host becomes important because several business systems can depend on it.
Virtual Machine
What it means: A virtual machine is a software-defined computer with its own operating system, memory, CPU allocation, disks and network interfaces.
In normal business language: It behaves like a separate server even though several VMs may share one physical machine.
Why the decision matters: VMs are useful for separating roles such as domain control, file sharing and applications while keeping management and recovery flexible.
Firewall
What it means: A firewall controls which network connections are allowed between users, systems and external networks.
In normal business language: It is a security checkpoint between parts of the company network. It should allow legitimate work while blocking unwanted access.
Why the decision matters: Firewall rules should describe real business flows such as 'staff may reach accounting on HTTPS', not unexplained broad permits.
NAT
What it means: NAT changes IP addresses as traffic crosses a network boundary.
In normal business language: It is similar to a company switchboard: many internal extensions can share one public number.
Why the decision matters: NAT helps with address use and publishing services, but it is not a substitute for firewall security.
PoE
What it means: Power over Ethernet sends both data and electrical power over the same Ethernet cable.
In normal business language: A camera or access point can use one cable instead of separate network and power wiring.
Why the decision matters: PoE can simplify installation and UPS protection, but the switch power budget and cable quality still need to be designed.
Chapter contents
2.1 Start with camera requirements
For each camera record resolution, codec options, configured frame rate, expected bitrate or bitrate range, PoE requirement, environment, mounting position and retention requirement. Do not calculate storage from megapixels alone.
Calculate aggregate traffic
If 20 cameras are configured for 6 Mbps average each, the arithmetic average video load is 120 Mbps before protocol overhead and variation. That number is a planning input for switch uplinks and NVR inbound bandwidth. Use the actual configured/expected bitrate for the camera scene and codec.
Storage
Storage depends on bitrate x recording time x retention period. Variable bitrate cameras can change substantially with scene motion and complexity. Treat the calculator result as a planning value unless it uses measured bitrate from the final configuration.
PoE
IR illuminators, heaters, PTZ motors and accessories can raise power demand. Size the switch from the actual camera power data and verify the total switch budget. Commission the system at night or under the power state that produces the highest expected camera load when practical.
Network segmentation
A dedicated camera VLAN can simplify addressing, firewall policy and troubleshooting. The correct policy depends on the customer's architecture. At minimum, know which systems need access to cameras, which need access to the NVR/VMS and which management stations are authorised.
NVR limits
Check the recorder's published inbound bandwidth, camera count, codec support, storage bays and drive compatibility. A recorder can have enough physical ports or licences but still have an inbound bitrate limit.
What works well
- One camera ID tied to switch port, IP address and physical location.
- UPS backing for the entire recording path, not only the NVR.
- Measured bitrate after final camera settings are applied.
- Separate recording, management and client-access requirements in the design.
Client benefit
Correct design prevents the common failure where cameras look fine individually but the uplink, PoE budget or recorder cannot handle the full system at peak load.
Security, NVR and KVM Guide | PoE Playbook | Camera Storage Calculator
Training manual: design from bitrate, not megapixels
Bandwidth example
If 24 cameras are configured for an observed average of 5 Mbps each, the simple average aggregate is 120 Mbps. That is not yet the complete switch-uplink design because bitrate can vary and other traffic exists, but it is far more useful than saying "24 x 4K cameras".
Storage arithmetic
For a constant 5 Mbps stream:
5 megabits/s x 3600 x 24 / 8 = 54,000 megabytes per day before unit conversion and overhead assumptions.
For 24 such streams, the raw arithmetic is 1,296,000 MB/day. Real deployments should use the camera's configured or measured average bitrate and the desired retention schedule. Variable bitrate can move significantly with motion, lighting and scene complexity.
Switch design
- Enough physical access ports.
- Enough PoE per port.
- Enough total PoE budget.
- Enough uplink capacity for aggregate camera traffic.
- Enough UPS capacity for the switch and NVR if recording must continue during outage.
Commissioning at the camera
- Confirm final field of view and focus.
- Set resolution, codec, frame rate and bitrate mode.
- Confirm time/NTP.
- Confirm IP/VLAN and recorder registration.
- Check night mode or IR behaviour.
- Record switch port and camera ID.
- Check live and recorded playback.
Failure mode: cameras freeze at busy times
Check NVR inbound bandwidth, switch uplink utilisation, packet loss, interface errors and camera bitrate changes. Do not assume a storage disk problem because the symptom is visible on recorded video.
DEEPER TEACHING
Sizing CCTV as a network, power and storage system
An IP camera system is a networked application with three simultaneous resource requirements: bandwidth, PoE power and storage. A camera that is physically installed but poorly planned can overload a switch, exhaust the recorder or create a single point of failure.
Bandwidth calculation
If 24 cameras each average 5 Mb/s to the recorder:
24 cameras x 5 Mb/s = 120 Mb/s average recording traffic
That does not mean a 100 Mb/s uplink is "almost enough". The design needs headroom for bitrate variation, management, playback and other traffic. Use actual camera codec/bitrate settings and the recorder vendor's requirements.
Raw storage calculation
For a simplified constant-bitrate estimate:
120 Mb/s ÷ 8 = 15 MB/s
15 MB/s x 86,400 seconds/day = 1,296,000 MB/day
≈ 1.296 TB/day decimal
30 days ≈ 38.9 TB raw data
This is raw arithmetic before filesystem, RAID, variable bitrate, retention policy, motion recording or recorder overhead. It demonstrates why "24 cameras" or megapixel count alone is not enough to size storage.
PoE calculation
Suppose 20 cameras are specified at 12 W maximum and four PTZ cameras at 30 W maximum:
20 x 12 W = 240 W
4 x 30 W = 120 W
Total maximum specified device load = 360 W
The switch must support the required per-port PoE standard and enough total power budget, with appropriate engineering headroom. Night-time IR, heaters, PTZ motors and accessories can change demand.
Separate camera traffic
A dedicated camera VLAN does not automatically make the system secure, but it creates a useful policy boundary. Ordinary users typically do not need direct access to every camera. The NVR/VMS, authorised management stations, time/DNS services and any required update path can be explicitly permitted.
Commissioning at the worst time
Do not commission only at midday when cameras draw the least power and scenes are easy to encode. Check after dark where possible. IR illumination, noise in the image and PTZ activity can increase bitrate and power demand.
Acceptance evidence
- Each camera ID mapped to switch port, location and IP.
- PoE class/allocation and peak behaviour checked.
- Recording bitrate and storage retention verified.
- Time synchronisation confirmed so recorded evidence has consistent timestamps.
- Playback and export tested, not only live view.
- Failure of one uplink or power source tested if redundancy is part of the design.
WORKED BUSINESS SCENARIO
Scenario: one switch carries staff, phones and cameras
A 48-port managed switch supports office PCs, VoIP phones, access points and CCTV cameras. The company wants separation and resilience without installing four separate physical networks.
What the chapter teaches us: VLANs, trunks, STP and link aggregation let one switching platform support several logical services, but only if the traffic path and redundancy are understood.
Think it through
- Which endpoints belong in which VLAN?
- Which links must carry multiple VLANs?
- What happens when a redundant Layer 2 path is added without loop control?
PRACTICAL WORK
Hands-on lab
Connect a known PoE device and record switch power allocation, actual draw if available, cable result and behaviour during peak device load.
Troubleshooting exercise
A camera reboots at night. Compare switch PoE budget, device peak load, cable resistance or termination and behaviour on a short known-good cable.
Chapter field checklist
- I can explain the subject without relying only on acronyms.
- I can draw or describe the main traffic, storage, power or service path.
- I know what normal operation should look like.
- I know which logs, counters or test results prove the result.
- I can explain the business impact if this component fails.
- I would document the final configuration and evidence at handover.
Chapter summary
IP Camera, PoE Switch and NVR Network Design Playbook should now be understood as a business service with a technical implementation, not simply a collection of commands or product names. The important habit is to know the purpose, understand the dependencies, measure the result and document what was proven.
END OF CHAPTER
Review questions
- Explain the subject in plain language to a business owner.
- List the main dependencies that must be healthy before this service can work.
- Describe one realistic failure and the first three pieces of evidence you would collect.
- Explain what should be documented at handover.
- What is the difference between an access port and a trunk?
- Why is loop prevention required when redundant Layer 2 paths exist?
A good answer should explain the reason, not only repeat a product name or command.