Choosing a **commercial video surveillance system** is no longer a facilities-only decision. IT owns the network, identity, and cyber posture. Facilities owns coverage, retention, and day-two operations. Security leadership owns policy and investigations. The projects that succeed treat **IP cameras**, **VMS / VSaaS**, **NVR storage**, and **network design** as one system.

This guide is written for teams evaluating **cloud-based video surveillance**, hybrid recording, and traditional on-premise VMS—especially if you are comparing platforms in the same class as **Verkada**, **Axis**, **Eagle Eye**, **Rhombus**, **Avigilon**, or open VMS stacks with ONVIF cameras.

## Start With Outcomes, Not Megapixels

Before you shop cameras, write down:

- What incidents must you reconstruct (theft, workplace safety, after-hours access, vehicle gates)?
- How many days of **retention** do insurance, legal, and operations require?
- Who needs live view vs search vs clip export—and from where (office, phone, SOC)?
- Will video integrate with **access control**, alarms, or intercoms?
- Are you single-site or **multi-site** with centralized monitoring?

Megapixel counts without answers to those questions produce expensive blind spots.

## Architecture Choices: Cloud, On-Premise, and Hybrid

### Cloud video / VSaaS

Cloud platforms centralize administration, user roles, and often AI search. They typically need reliable WAN, outbound connectivity, and clear data-handling agreements. Strengths: multi-site consistency, faster feature updates, simpler remote access. Trade-offs: recurring license cost, bandwidth planning, vendor dependency.

### On-premise NVR / VMS

Local recording keeps media on-site and can reduce WAN load. Strengths: control over storage geography, familiar for some security teams. Trade-offs: patching, backups, remote access design, and hardware lifecycle you own.

### Hybrid

Edge recording with cloud management (or cloud backup of critical clips) is common in commercial rollouts. Validate failover behavior when the internet drops: do cameras keep recording locally, and how do operators retrieve footage later?

For a deeper cost and ops comparison, see our guide on [cloud vs on-premise surveillance](/blog/cloud-vs-onpremise-surveillance).

## Camera Selection That Survives Real Buildings

Match form factor to the job:

- **Dome / bullet** for general perimeter and corridors
- **Multi-sensor / panoramic** for large open areas with fewer mounts
- **Low-light / color-at-night** where after-hours incidents matter
- **LPR / vehicle** cameras for gates and parking (confirm illumination and angle)
- **Outdoor weather ratings** and mount kits for Southern California sun, coastal corrosion, and warehouse dust

Also plan **lens FOV**, mounting height, and privacy masking for lobbies and neighboring properties—investigators need usable faces and plates, not just “a person walked by.”

## Network Design Is Part of the Surveillance Spec

A commercial CCTV design that ignores networking fails at commissioning:

- Place cameras on a dedicated **surveillance VLAN**
- Size **PoE switches** for worst-case camera draw plus growth
- Use tested **structured cabling** (and fiber between buildings when copper distance fails)
- Document firewall allow-lists for VSaaS or remote VMS access
- Avoid putting cameras on guest Wi-Fi or the same flat LAN as user laptops

Our companion article on [VLAN segmentation for cameras and access control](/blog/vlan-segmentation-surveillance-access-control) covers segmentation patterns in more detail.

## Storage, Retention, and Bandwidth Math

Rough workflow:

1. Pick resolution, FPS, and codec per camera class (entrance vs warehouse overview)
2. Estimate bitrate from vendor tools—not brochure peaks
3. Multiply by camera count and retention days for on-prem capacity
4. For cloud platforms, estimate **upload** during motion-heavy hours and live-view concurrency
5. Add headroom for investigations (multiple operators scrubbing the same day)

Underestimating retention is a legal and insurance risk. Overestimating without tiering (critical doors vs parking overview) wastes budget.

## Cybersecurity for Cameras and Recorders

Treat video infrastructure like production IoT:

- Change default passwords; prefer SSO / MFA for cloud consoles
- Block inbound management from the public internet
- Patch cameras, NVRs, and appliances on a schedule
- Segment management interfaces; log admin actions
- Review who can export clips—video is sensitive PII in many workplaces

A hardened camera network supports zero-trust goals: least privilege, continuous verification, and limited blast radius.

## Integrating Video With Access Control and Entry Systems

The highest-value commercial deployments correlate **badge events** with **video**:

- Door forced / held open → automatic camera bookmark
- Intercom call → nearby camera in the operator view
- After-hours access → clip packaged for security review

Whether you standardize on a unified stack or best-of-breed (for example cloud access plus partner VSaaS), require an integration path in the RFP—not a slideware promise.

Explore related platform comparisons in our [security platform comparisons](/comparison) library, including Verkada- and Brivo-focused guides written for IT and physical security stakeholders.

## Multi-Site Operations Checklist

For retail chains, property managers, and distributed offices:

- Standard camera naming and site codes
- Role-based access so local managers see only their sites
- Shared playbooks for clip export and chain of custody
- Health monitoring (offline cameras, storage filling, license expiry)
- Staged rollout: pilot site → template → fleet

Consistency beats one-off “integrator specials” at each address.

## Procurement Pitfalls

- Buying cameras before confirming VMS / VSaaS licensing model
- Ignoring total cost: licenses, storage, switch upgrades, lifts, permits
- Skipping a night-time pilot for parking and loading docks
- No owner for firmware and user offboarding
- Designing for today’s door count with zero spare PoE or cable pathways

## How SiriusPackets Approaches Surveillance Projects

We design **surveillance** alongside **networking**, **structured cabling**, **wireless**, and **access control**—so the camera plan matches switch stacks, IDF capacity, and identity policy. Whether you lean cloud-native or hybrid with Axis-class optics and open VMS options, the network and retention design decide whether the system works on day 400, not just day one.

If you are scoping a commercial CCTV refresh or multi-site VSaaS migration, [contact SiriusPackets](/contact) for a design review grounded in real deployment constraints—bandwidth, PoE, cybersecurity, and operator workflow included.

Commercial Video Surveillance System Design Guide for IT and Facility Teams

Enterprise security used to mean a locked closet and a stack of DVRs. Today it means **IP cameras**, **cloud video surveillance (VSaaS)**, **cloud access control**, intercoms, and sensors sharing the same campus network as users and servers. If those devices sit on a flat LAN, a compromised camera or reader can become a foothold into the rest of the environment.

This guide walks through how IT and security teams should design **VLAN segmentation**, **Power over Ethernet (PoE)**, and **firewall policy** for physical security systems—without treating cameras and door controllers like ordinary office PCs.

## Why Physical Security Belongs on Its Own Network Segments

Surveillance cameras and access control panels are specialized IoT endpoints. They need:

- Reliable **PoE** power and stable bandwidth
- Outbound connectivity to cloud platforms (or controlled paths to on-prem NVRs / VMS)
- Protection from user devices, guest Wi-Fi, and the public internet
- Clear blast-radius limits if firmware or credentials are abused

Putting every camera and reader on the corporate data VLAN fails all four goals. Dedicated security VLANs (often plural—cameras vs access vs intercom) are the baseline for commercial buildings, multi-site retail, healthcare campuses, and warehouses.

## Recommended VLAN Layout for Commercial Security

A pattern we deploy repeatedly for Southern California campuses and multi-building portfolios:

| VLAN / segment | Typical devices | Notes |
| --- | --- | --- |
| Camera / video | IP cameras, encoders, local NVRs | Highest bandwidth; often QoS-sensitive for live view |
| Access control | Controllers, PoE readers, some lock interfaces | Lower bandwidth; high availability for doors |
| Intercom / entry | Video intercoms, gate controllers | Real-time audio/video; isolate from guest Wi-Fi |
| Building / BMS (optional) | Sensors, limited IoT | Only if policy requires separation from security |
| Management | Jump hosts, admin workstations, out-of-band | Strict source restrictions |

Avoid one mega “IoT VLAN” that mixes cameras, printers, thermostats, and badge readers. That recreates a flat network with a prettier name.

## Core Design Principles

### 1. Default deny between security and user networks

Cameras should not initiate sessions to finance servers. Workstations should not SSH into every NVR on the floor. Use firewall or Layer 3 ACL policy:

- Allow **management hosts** (or ZTNA brokers) to reach camera/access admin interfaces
- Allow cameras to reach **VMS / VSaaS / NVR** destinations only
- Allow access controllers outbound HTTPS (or vendor-specific ports) to cloud control planes
- Block east-west chatter between camera VLAN and access VLAN unless a specific integration needs it

### 2. Prefer outbound cloud models when the platform supports them

Platforms like **Verkada**, many **Brivo** / cloud access stacks, and modern VSaaS products often rely on **outbound HTTPS** rather than inbound port forwards. That reduces attack surface and fits zero-trust thinking: devices call home; you do not expose them to the internet.

### 3. Treat PoE as a first-class design constraint

Undersized PoE is one of the most common post-install failure modes. Budget:

- Per-port power (especially PTZ, multi-sensor, IR heaters, and powered readers)
- Per-switch and per-PSU totals with headroom for growth
- Spare ports in each IDF for future doors and cameras
- UPS runtime for PoE switches that keep doors and critical cameras alive during short outages

### 4. Align cabling with the security plan

**Cat6 / Cat6A structured cabling**, correct pathway design, and tested permanent links matter as much as the switch SKU. Long outdoor runs, inter-building fiber, and camera mounts without weather-rated terminations show up later as “mystery” drops—not as clean design choices.

## Bandwidth and QoS for Video

Rough planning guidance (always validate against codec, resolution, FPS, and vendor datasheets):

- Estimate **sustained bitrate per camera** at the quality you actually record (not marketing maximums)
- Multiply by concurrent live-view sessions for ops centers
- Separate **recording / uplink** paths from general internet browsing
- Apply QoS so security video is not starved by backups or large file transfers

Cloud video platforms change the math: more traffic may leave the site toward the vendor cloud. Size WAN / SD-WAN accordingly for multi-site rollouts.

## Firewall and Identity Checklist

Before go-live, document:

1. **FQDNs and IPs** each vendor requires (and how often they change)
2. **DNS** strategy for devices (trusted resolvers; avoid consumer DNS on security VLANs)
3. **Certificate / TLS** expectations for cloud agents
4. **Admin access path**: VPN, ZTNA, or jump host—never direct RDP/SSH from the internet to NVRs
5. **Logging**: send firewall allows/denies and switch auth events to your SIEM where possible

If you are moving toward zero trust, physical security VLANs should be early candidates for **least privilege** and continuous monitoring—not afterthoughts.

## Multi-Site Consistency Without Copy-Paste Chaos

For portfolios (retail, property management, distributed clinics):

- Standardize **VLAN IDs and naming** across sites where practical
- Use templates for switch configs (camera VLAN, access VLAN, uplink trunks)
- Keep a living matrix of **vendor cloud destinations** per platform
- Stage a pilot site, then replicate—do not invent a new topology per building

## Common Mistakes We See

- Cameras on the same SSID or VLAN as guest Wi-Fi
- Flat Layer 2 between buildings “for convenience”
- Inbound NAT to NVRs “just for the integrator”
- No spare PoE for the next ten doors on the roadmap
- Access control and cameras sharing one VLAN with no ACL between them
- Skipping documentation so the next IT hire cannot tell which subnet is which

## How This Fits SiriusPackets Deployments

When we design **enterprise networking**, **structured cabling**, **wireless**, **surveillance**, and **access control** together, VLAN and PoE plans are part of the same drawing set—not a punch-list item after cameras are hung. That is how you get stable Verkada / Axis / Brivo-class systems on networks that still pass an IT security review.

If you are planning a camera refresh, multi-site access control rollout, or campus re-cabling, start with segmentation and power budgets. The right VLAN design turns physical security into a controlled workload—not an unmanaged IoT risk.

[Get a free quote](/contact) if you want a site survey and a network design that matches your camera and door counts—not generic switch defaults.

Designing Secure VLANs for Surveillance Cameras and Access Control Systems

Zero trust architecture has become the gold standard for enterprise network security. Unlike traditional perimeter-based security models that assume everything inside the network is trustworthy, zero trust operates on the principle of "never trust, always verify."

## Why Zero Trust Matters Now

With the rise of remote work, cloud services, and IoT devices, the traditional network perimeter has dissolved. Employees access company resources from home networks, coffee shops, and mobile devices. Cloud applications live outside your data center. Smart building systems connect to your network through access control panels and surveillance cameras.

The perimeter is no longer a physical boundary. It's a logical construct that exists wherever your users and devices are located. This fundamental shift requires a new approach to network security.

## Key Components of a Zero Trust Implementation

1. **Identity Verification**: Every user and device must be authenticated before accessing any resource. This includes multi-factor authentication (MFA) and certificate-based authentication for devices. Identity becomes the new perimeter.

2. **Micro-Segmentation**: Instead of a flat network where any device can communicate with any other device, micro-segmentation creates isolated zones. Your surveillance cameras shouldn't be able to talk to your financial databases. Each segment operates as its own security domain.

3. **Least-Privilege Access**: Users and devices get only the minimum access they need to perform their function. An access control panel needs to communicate with its management server, nothing else. This principle applies at every layer of the network.

4. **Continuous Monitoring**: Trust is not a one-time decision. Every session, every request is continuously evaluated for risk signals. Behavioral analytics detect anomalies that might indicate a compromised account or device.

## ZTNA, VPN, and SASE: How the Pieces Fit

Many teams conflate zero trust with “replace VPN.” In practice:

- **Traditional VPN** often grants broad L3 access to a flat network once connected—helpful for migration, risky as a long-term posture.
- **Zero Trust Network Access (ZTNA)** brokers application-level access based on identity, device posture, and policy—usually a better fit for SaaS and private apps.
- **SASE** combines security services (SWG, CASB, FWaaS, ZTNA) with SD-WAN—useful when you want consistent policy for offices and remote users.

Zero trust is the philosophy; ZTNA and SASE are common delivery models. Your architecture may combine them during transition.

## Logging, Visibility, and Response

Zero trust without telemetry is policy on paper. Plan for:

- **North-south and east-west visibility**: Flow logs, firewall logs, and identity provider signals should correlate in a SIEM or XDR-style platform.
- **Automation**: Low-risk anomalies can be challenged with step-up MFA; high-risk sessions should be blocked or isolated automatically where possible.
- **Retention and privacy**: Align log retention with legal and regulatory requirements—especially if you operate in multiple jurisdictions.

## Common Pitfalls We See in the Field

- **Segmentation without maintenance**: Rules rot as applications move. Schedule quarterly reviews tied to change management.
- **Over-reliance on VLANs alone**: VLANs separate broadcast domains; enforcement still requires L7 policy and identity—usually at the firewall or ZTNA layer.
- **Shadow IT bypassing identity**: If SaaS adoption outpaces SSO, users create parallel accounts. Prioritize SAML/OIDC onboarding for critical apps.

## Implementation Roadmap

For most enterprises, zero trust is a journey, not a switch you flip overnight. We recommend starting with:

1. **Asset Inventory and Classification**: You can't protect what you don't know exists. Comprehensive asset discovery and classification is the foundation.

2. **Identity and Access Management (IAM) Modernization**: Modernize your identity systems to support certificate-based device authentication and adaptive MFA policies.

3. **Network Segmentation**: Implement network segmentation using next generation firewalls from vendors like Fortinet, Palo Alto, or Juniper. Start with critical assets and expand from there.

4. **Endpoint Detection and Response (EDR)**: Deploy EDR solutions that provide visibility into endpoint behavior and can automatically respond to threats.

5. **Continuous Monitoring and Analytics**: Implement security information and event management (SIEM) or security orchestration, automation, and response (SOAR) platforms to correlate events and detect threats.

## Phased Rollout Checklist

- Define crown-jewel applications and data stores first
- Pilot ZTNA or tightened firewall policies with a small user group
- Measure help-desk impact and tune policies before broad rollout
- Document exceptions and sunset dates—temporary bypasses become permanent risks

At SiriusPackets, we've helped organizations across industries implement zero trust architectures that actually work, balancing security with usability. The key is understanding that zero trust isn't about buying a single product. It's about redesigning how your network thinks about trust, moving from implicit trust to explicit verification at every step.

Building a Zero Trust Network Architecture for Modern Enterprises

The surveillance industry has undergone a massive shift toward cloud based solutions. Vendors like Verkada have disrupted the traditional NVR/DVR model by offering cameras that stream directly to the cloud. But is cloud based surveillance always the right choice?

## Cloud Based Surveillance: The Advantages

Cloud based systems like Verkada offer compelling benefits:

- **Zero on-site infrastructure**: No NVR, no dedicated server room space, no UPS sizing for recording equipment
- **Automatic updates**: Firmware and software updates happen automatically
- **Remote access**: View any camera from anywhere with an internet connection
- **AI analytics**: Cloud platforms can leverage powerful AI for people counting, license plate recognition, and anomaly detection
- **Scalability**: Adding cameras is as simple as plugging them in

## On Premise Surveillance: When It Still Makes Sense

On premise systems using Axis cameras or Ubiquiti UniFi Protect have their place:

- **Bandwidth constraints**: If your site has limited internet bandwidth, sending dozens of HD streams to the cloud may not be feasible
- **Regulatory requirements**: Some industries require video data to remain on-site
- **Total cost of ownership**: For very large deployments, on-premise can be more cost-effective over time
- **Network independence**: On-premise systems continue recording even if your internet goes down

## Bandwidth, Egress, and Traffic Engineering

Cloud surveillance is not “just cameras on Wi‑Fi.” Enterprise deployments need a deliberate traffic plan:

- **Per-camera bitrate**: HD and 4K streams vary by scene complexity, frame rate, and codec. Aggregate uplink demand across all cameras before you standardize on a cloud vendor.
- **Burst behavior**: Motion events and AI features can change upload patterns. Work with your ISP or SD-WAN design for sustained headroom, not just average use.
- **Local buffering**: Many hybrid designs buffer on-camera or on a small gateway so short WAN outages do not mean lost evidence—confirm how your chosen platform behaves during brownouts.

If your WAN is the bottleneck, hybrid or on-prem recording with cloud management often preserves remote visibility without saturating the pipe.

## Retention, Chain of Custody, and Compliance

Retention policies drive storage architecture as much as camera count:

- **Legal hold and export**: Understand how long footage is kept, how exports work for investigations, and whether metadata is preserved for chain of custody.
- **Data residency**: Cloud vendors differ on regions and sovereignty options; regulated customers should validate contracts and architecture diagrams, not just marketing pages.
- **Audit trails**: Who viewed which clip, when, and from where—critical for internal investigations and some regulatory frameworks.

## The Hybrid Approach

For many organizations, the answer is a hybrid model: cloud management with on-site recording, or a mix of cloud cameras for critical areas and on premise cameras for the rest. This approach allows you to leverage the benefits of both architectures while mitigating their respective limitations.

Hybrid also helps when you are migrating: phase critical sites to cloud while legacy buildings stay on NVR until refresh cycles align.

## Making the Decision

We evaluate several factors when advising clients on surveillance architecture:

1. **Scale and Growth**: Number of cameras and expected growth over the next 3-5 years. Cloud solutions scale more easily, but on premise can be more cost effective at very large scales.

2. **Network Infrastructure**: Available internet bandwidth and redundancy. Cloud systems require reliable, high-bandwidth connections. On premise systems can operate independently of internet connectivity.

3. **Regulatory and Compliance Requirements**: Some industries require video data to remain on-site. Healthcare, financial services, and government contracts often have specific data residency requirements.

4. **Budget Model**: Capital expenditure (CapEx) versus operational expenditure (OpEx) preference. Cloud solutions shift costs to OpEx, while on premise requires larger upfront investment.

5. **Integration Requirements**: Needs with access control systems, alarm systems, and other security infrastructure. Some platforms offer deeper integration than others.

## Operational Questions to Ask Vendors

Use this checklist in RFPs and design reviews:

- Uptime SLA for cloud management and viewing—not just cameras
- RTO/RPO for cloud storage and local failover paths
- Integration APIs for access control, identity, and ticketing systems
- Export formats and whether third-party VMS or evidence tools are supported
- NDAA / country-of-origin posture for cameras and software components

## Frequently Asked Questions

**Does cloud surveillance work if the internet is down?**  
It depends on architecture. Pure cloud recording may limit live viewing or clip retrieval during outages unless local buffering or hybrid recording is designed in. Always validate failover behavior in a pilot.

**Is on-prem automatically more secure?**  
Not automatically. On-prem shifts responsibility to your team for patching, segmentation, and backups. Cloud shifts operational burden but requires trust in the vendor’s security program—evaluate both under your risk model.

**When is hybrid the best compromise?**  
When you need remote management and AI from the cloud but must keep primary storage local for bandwidth, latency, or compliance—hybrid is often the sweet spot for multi-site enterprises.

The surveillance landscape is evolving rapidly. Whatever direction you choose, the most important thing is selecting a platform that integrates well with your broader security ecosystem and aligns with your organization's long-term technology strategy.

Cloud Based vs On Premise Surveillance: Making the Right Choice

Data center cabling is the backbone of your IT infrastructure. Poor cabling leads to troubleshooting nightmares, airflow restrictions, and scalability limitations. Here's how to get it right.

## Planning: Measure Twice, Cable Once

Before a single cable is pulled, you need comprehensive planning:

1. **Detailed Floor Plans**: Showing rack positions, cable pathways, and patch panel locations. This includes both horizontal and vertical pathways.

2. **Port Mapping Documentation**: A document that ties every cable to a specific source and destination. This becomes invaluable during troubleshooting and future expansions.

3. **Capacity Planning**: Plan for current needs plus 30-50% growth. Over-provisioning cable infrastructure is far less expensive than retrofitting later.

4. **Environmental Considerations**: Temperature zones, airflow paths, fire suppression systems. Cables can impact cooling efficiency, and fire suppression systems affect cable routing options.

## Standards and References That Matter

Structured cabling in commercial and data center environments typically aligns with **TIA-568** family standards for copper and **TIA-942** for data center topology guidance. Fiber work should respect **ANSI/TIA-568.3** (optical fiber) and manufacturer bend-radius limits. Your team should treat “close enough” as unacceptable when auditors or uptime targets are on the line.

## Physical Infrastructure

**Raised Floor vs Overhead Cable Tray**: Both approaches have merit. Raised floor installations keep cables out of sight and allow easy access, but limit airflow management in hot/cold aisle configurations. Overhead cable tray systems are increasingly preferred for modern data centers because they leave the under-floor space clear for cooling, improving overall efficiency.

**IDF/MDF Design**: Your Main Distribution Frame (MDF) and Intermediate Distribution Frames (IDF) are the nerve centers of your network. Design them with:

- **Adequate Rack Space**: Plan for current needs plus 30-50% growth. Consider both network equipment and cable management space.

- **Proper Grounding and Bonding**: Critical for electrical safety and signal integrity. Follow TIA/EIA standards for grounding systems.

- **Redundant Power Feeds**: Ensure both A and B power feeds are available, ideally from different UPS systems or utility feeds.

- **Environmental Monitoring**: Temperature and humidity sensors to detect conditions that could damage equipment or cables.

- **Physical Security**: Door access control and cameras to protect critical network infrastructure.

## Cable Selection

For horizontal runs: Cat6A is the standard for new installations, supporting 10 Gigabit Ethernet up to 100 meters. Don't cut corners with Cat5e, the cost difference is minimal and you'll thank yourself in 3-5 years.

For backbone/vertical runs: Single-mode fiber for long distances and maximum future-proofing. Multi-mode OM4 fiber for shorter runs where cost is a factor.

## Fiber Connectors, Panels, and Migrations

- **LC duplex** remains common for patch fields; **MPO/MTP** trunks appear frequently in high-density spine-leaf builds—plan polarity and gender carefully to avoid expensive rework.
- **Color coding** and **port labeling** at both ends prevent midnight mistakes during cutovers.
- When migrating links, **document loss budgets** per span so you can tell optical degradation from a bad patch later.

## Cable Management

The difference between a good installation and a great one is cable management:

- Use velcro ties, never zip ties (you'll need to add/remove cables later)
- Maintain bend radius specifications, fiber is especially sensitive
- Label everything: both ends of every cable, every patch panel port, every rack
- Document as you go, don't leave documentation for "later"

## Testing and Certification

Every cable run should be tested and certified using a Fluke or equivalent tester. Document results and keep them on file. This saves countless hours when troubleshooting issues months or years later.

For fiber, include **OTDR traces** where appropriate for long runs, and store baseline measurements after commissioning.

## Deliverables You Should Expect from a Professional Install

- As-built drawings with rack elevations and pathway notes
- Test reports packaged by IDF/MDF and by date
- Labeling scheme document (so the next engineer can follow your convention)
- Punch list sign-off before final payment

## Future Moves, Adds, and Changes (MACs)

Data centers evolve. Leave **spare conduit capacity**, **empty patch panel positions**, and **slack management** that doesn’t block airflow. The cheapest time to add capacity is when the floor is already open.

At SiriusPackets, our structured cabling team handles everything from small office wiring to full data center builds. We design for today's needs and tomorrow's growth.

Structured Cabling Best Practices for Data Center Deployments

We see it all the time: a business buys 20 high-end access points, mounts them in a grid pattern on the ceiling, and then complains about poor wireless performance. The problem isn't the hardware, it's the design methodology.

## The Problem with "Just Add More APs"

More access points don't automatically mean better coverage. In fact, too many APs can cause co-channel interference that degrades performance for everyone. Enterprise wireless design is as much about where NOT to place APs as where to place them.

## Predictive Surveys: Design Before You Deploy

A predictive survey uses floor plans and building materials data to model RF propagation. This allows us to:

- Determine optimal AP placement before drilling a single hole
- Identify potential problem areas (concrete walls, elevator shafts, metal structures)
- Calculate the right number of APs for your coverage and capacity requirements
- Select the right antenna types for different environments

## Spectrum Analysis: Understanding Your RF Environment

Before deploying any wireless network, you need to understand what's already in the air:

- Neighboring WiFi networks that could cause interference
- Non-WiFi interference sources (microwaves, Bluetooth devices, wireless cameras)
- Regulatory considerations for outdoor deployments

## Capacity vs Coverage: Design for Both

Coverage means “can I associate?” Capacity means “can I sustain the apps I need when the room is full?”

- **High-density venues** (auditoriums, conference centers) need careful channel planning, reduced cell size, and sometimes dedicated high-density AP modes—not just more power.
- **Office environments** often fail on roaming and sticky clients long before raw RSSI looks bad. Validate roaming with real devices, not just survey software heat maps.

## Wi‑Fi 6, 6E, and Planning for the Future

Newer standards bring OFDMA, better MU-MIMO behavior, and (where 6E is available) additional spectrum in the 6 GHz band. They do not fix bad placement. When you refresh hardware, revisit channel plans and minimum RSSI targets—your old 5 GHz plan may not translate one-to-one.

## The Right Hardware for the Right Environment

Different environments call for different solutions:

- **Office spaces**: Indoor APs from Cisco, Aruba, or Juniper Mist with omnidirectional antennas
- **Warehouses**: High-gain directional antennas to cover large open areas
- **Outdoor spaces**: Weatherproof APs from Cambium or Fortinet with proper mounting hardware
- **High-density areas**: APs with advanced beamforming and MU-MIMO capabilities

## Guest Wi‑Fi and Segmentation

Enterprise SSIDs should land users on isolated VLANs with outbound filtering—never flat into your server VLAN. Captive portals, rate limits, and client isolation reduce blast radius if a guest device is compromised.

## Post-Deployment Validation

After installation, we perform active site surveys to validate that the design meets the performance requirements. We test for:

- Signal strength and signal-to-noise ratio in all coverage areas
- Roaming behavior between APs
- Throughput testing at various locations
- Application-specific testing (video conferencing, VoIP, etc.)

## Troubleshooting Patterns We See After Go-Live

- **Sticky clients** that won’t roam: tune minimum data rates and band steering carefully—aggressive settings can backfire on older devices.
- **DFS events** on 5 GHz: radar hits can force channel changes; design with DFS-aware channel lists and monitoring.
- **Power levels too high**: APs “hear” each other and clients stick to the wrong AP—sometimes reducing TX power improves real-world performance.

## Documentation and Handover

A proper handover package includes:

- As-built AP names, locations, and switch port mappings
- SSID/VLAN matrix and RADIUS settings (if applicable)
- Survey reports (predictive and validation)
- Change window notes for future additions

Getting wireless right the first time saves money, reduces user frustration, and ensures your network can support the applications your business depends on.

Enterprise Wireless Design: Beyond Just Hanging Access Points

Access control systems are no longer standalone devices running on their own isolated networks. Modern platforms like Verkada, PDK Prodatakey, and Genea are cloud-managed, IP-based systems that run on your enterprise network. This means your IT team needs to be involved from the very first planning meeting.

## The Network Requirements

Cloud-based access control systems need:

- **Reliable network connectivity**: If the network goes down, people can't get in (or out). PoE switches with UPS backup are essential.
- **Bandwidth**: While access control doesn't use much bandwidth per door, it adds up across a large facility. Factor in video verification feeds from integrated cameras.
- **VLAN segmentation**: Access control devices should be on their own VLAN, isolated from general user traffic.
- **Firewall rules**: Cloud-managed systems need outbound HTTPS to their management platform. On-premise systems need inbound access for remote management.

## Power over Ethernet (PoE) and Door Hardware Reality

Controllers, readers, and locks don’t all draw the same amount of power. When you stack PoE switches:

- Budget **per-port and per-switch** power budgets, not just port count
- Plan for **future doors** on the same IDF before you exhaust spare PoE headroom
- Long cable runs may require **higher gauge cable** or mid-span injectors—validate against vendor distance limits

Undersized PoE shows up as “random” offline doors after go-live, not during lab testing.

## Security Treat Access Control Like IoT

Readers and panels are attractive lateral-movement targets:

- **No inbound management from the internet** to controllers unless architected with zero trust or VPN—prefer cloud outbound or secure tunnels per vendor guidance
- **802.1X or MACsec** where supported for switch-to-device trust
- **Firmware cadence**: patch on a schedule tied to change windows, not “when something breaks”

## Choosing the Right Platform

Each platform has its strengths:

- **Verkada**: Tightly integrated with their camera platform. Great for organizations that want a unified security dashboard. Cloud-native.
- **PDK Prodatakey**: Cloud-based with strong mobile credential support. Good for multi-site management.
- **Axis**: Enterprise-grade with deep integration capabilities. Works well in complex environments.
- **Ubiquiti UniFi Access**: Cost-effective for smaller deployments, integrates with the broader UniFi ecosystem.
- **Genea**: Cloud-based with excellent visitor management and integration with workplace management tools.

## Integration with Other Systems

Modern access control doesn't exist in isolation. Consider integration with:

- Surveillance cameras (event-triggered recording)
- Alarm systems (intrusion detection)
- HR systems (automatic provisioning/deprovisioning)
- Visitor management
- Building management systems (HVAC, lighting)

## Identity: Beyond Badges

Enterprise deployments increasingly tie physical access to IT identity:

- **SCIM provisioning** from your IdP into the access platform where supported
- **Role-based access** aligned with HR status (joiner/mover/leaver)
- **Visitor and contractor workflows** with expiring credentials—reduces orphaned cards and PINs

## Resilience and Fail-Open vs Fail-Secure

Doors fail **open** or **secure** based on code, safety, and policy—not vendor defaults alone. Network design should align with life-safety expectations: battery-backed strikes, mechanical override plans, and clear runbooks for extended outages.

## A Practical Onboarding Sequence for IT

1. **Design VLANs, DHCP scopes, and firewall egress** before hardware ships
2. **Label switch ports** to panels in the same naming convention as your IPAM
3. **Pilot a single building** with full monitoring (SNMP, syslog) before multi-site rollout
4. **Document** certificate expirations for cloud connectors and API keys

## The IT-Security Convergence

The days of physical security being managed entirely by a facilities team are over. Modern access control is an IT system that happens to control door locks. Organizations that recognize this convergence and involve their IT and network teams early in the process achieve better outcomes: more secure, more reliable, more integrated.

Integrating Access Control with Your Network Infrastructure

Choosing an enterprise firewall platform is one of the most consequential decisions an IT team makes. You'll be living with this choice for 5-7 years. Here's our honest assessment based on deploying all three platforms across dozens of environments.

## Fortinet FortiGate

Fortinet has grown from a UTM appliance vendor to a serious enterprise contender. Their custom ASIC-based architecture delivers impressive throughput at competitive price points.

*Strengths*: Price-to-performance ratio, FortiManager for centralized management, strong SD-WAN integration, growing ecosystem (FortiSwitch, FortiAP, FortiEDR)

*Considerations*: The management interface can be complex. FortiOS upgrades require careful planning and testing. Advanced features like ZTNA require additional licensing.

*Best for*: Organizations looking for strong performance at a competitive price, especially those adopting SD-WAN.

## Palo Alto Networks

Palo Alto pioneered the NGFW category and continues to set the standard for application aware security. Their Panorama management platform is best in class.

*Strengths*: Best in class application identification (App-ID), excellent Panorama centralized management, strong threat prevention, mature ZTNA/SASE offering (Prisma Access)

*Considerations*: Premium pricing, Palo Alto is typically the most expensive option. Licensing models can be complex. Hardware refresh cycles can be costly.

*Best for*: Organizations where security efficacy is the top priority and budget is less constrained. Heavily regulated industries.

## Juniper SRX

Juniper has been revitalizing its security portfolio, with tight integration into the broader Juniper networking stack (QFX switches, Mist wireless).

*Strengths*: Deep integration with Juniper networking products, strong routing capabilities, Mist AI for networking analytics, competitive pricing

*Considerations*: Smaller security market share means fewer integration partners. Junos can have a learning curve for teams familiar with other platforms.

*Best for*: Organizations already invested in the Juniper networking ecosystem, or those prioritizing networking/routing capabilities alongside security.

## Sizing, Throughput, and “Marketing Gbps”

Datasheet throughput rarely equals what you see with **SSL inspection**, **IPS**, and **IPsec** all enabled. Size appliances using **realistic blended traffic models**—often 40–60% of headline numbers depending on feature mix. If you’re encrypting everything, plan for **TLS decryption capacity** explicitly.

## High Availability and Change Windows

Enterprise deployments usually run **active/passive or active/active clusters**. Regardless of vendor:

- Validate **failover timing** for your applications (some tolerate seconds of flap; others do not)
- Standardize **configuration sync** and **version parity** across peers before major upgrades
- Keep **out-of-band management** reachable when in-band routing is in flux

## Logging, SIEM, and Operational Load

A firewall that nobody monitors is only marginally better than none. Plan for:

- **Syslog or native streaming** to your SIEM with retention aligned to compliance
- **Change audit trails** so you can prove who opened a rule, not just that it exists
- **Runbooks** for common incidents: crypto miner egress, lateral movement, DNS tunneling

## Upgrade and Patch Discipline

All three vendors ship frequent updates for threats and stability. The teams that win treat **quarterly upgrade windows** as non-optional, with lab validation for major jumps—especially when IPS signatures and decryption policies interact.

## Our Recommendation Framework

There's no universally "best" firewall. We evaluate based on several factors:

1. **Existing Infrastructure and Vendor Relationships**: If you're already invested in a vendor's ecosystem (switches, wireless, management platforms), staying within that ecosystem often makes sense.

2. **Primary Use Case**: Perimeter security, internal segmentation, SD-WAN, remote access. Different use cases favor different platforms. A firewall optimized for high-throughput perimeter security might not be ideal for granular internal segmentation.

3. **Management and Staffing Capabilities**: Can your team effectively manage the platform? Complex management interfaces require more training and expertise. Some organizations benefit from managed services.

4. **Budget and Licensing Flexibility**: Consider total cost of ownership over 5-7 years, not just initial purchase price. Licensing models vary significantly between vendors.

5. **Integration Requirements**: How does the firewall integrate with your SIEM, endpoint protection, identity systems, and other security tools? Integration depth varies.

## Questions to Ask in a Proof of Concept

- Application visibility accuracy on **your** SaaS stack (not vendor demo traffic)
- Performance with **TLS decryption** at your expected SSL percentage
- **API completeness** for automation (ticket-driven rule updates, drift detection)
- **Cloud-delivered security services** latency if you adopt SASE-style inspection

The best firewall is the one your team can manage effectively, that meets your security requirements, and that fits your budget over the full lifecycle. There's no substitute for hands-on evaluation in your specific environment.

Blog & Insights

Commercial Video Surveillance System Design Guide for IT and Facility Teams

Designing Secure VLANs for Surveillance Cameras and Access Control Systems

Building a Zero Trust Network Architecture for Modern Enterprises

Cloud Based vs On Premise Surveillance: Making the Right Choice

Structured Cabling Best Practices for Data Center Deployments

Enterprise Wireless Design: Beyond Just Hanging Access Points

Integrating Access Control with Your Network Infrastructure

Next Generation Firewalls: Fortinet vs Palo Alto vs Juniper - A Practical Comparison

Have a Project in Mind?
Let's Talk.

Blog & Insights

Commercial Video Surveillance System Design Guide for IT and Facility Teams

Designing Secure VLANs for Surveillance Cameras and Access Control Systems

Building a Zero Trust Network Architecture for Modern Enterprises

Cloud Based vs On Premise Surveillance: Making the Right Choice

Structured Cabling Best Practices for Data Center Deployments

Enterprise Wireless Design: Beyond Just Hanging Access Points

Integrating Access Control with Your Network Infrastructure

Next Generation Firewalls: Fortinet vs Palo Alto vs Juniper - A Practical Comparison

Have a Project in Mind? Let's Talk.

Have a Project in Mind?
Let's Talk.