Enterprise security used to mean a locked closet and a stack of DVRs. Today it means IP cameras, cloud video surveillance (VSaaS), cloud access control, intercoms, and sensors sharing the same campus network as users and servers. If those devices sit on a flat LAN, a compromised camera or reader can become a foothold into the rest of the environment.
This guide walks through how IT and security teams should design VLAN segmentation, Power over Ethernet (PoE), and firewall policy for physical security systems—without treating cameras and door controllers like ordinary office PCs.
Why Physical Security Belongs on Its Own Network Segments
Surveillance cameras and access control panels are specialized IoT endpoints. They need:
- Reliable PoE power and stable bandwidth
- Outbound connectivity to cloud platforms (or controlled paths to on-prem NVRs / VMS)
- Protection from user devices, guest Wi-Fi, and the public internet
- Clear blast-radius limits if firmware or credentials are abused
Putting every camera and reader on the corporate data VLAN fails all four goals. Dedicated security VLANs (often plural—cameras vs access vs intercom) are the baseline for commercial buildings, multi-site retail, healthcare campuses, and warehouses.
Recommended VLAN Layout for Commercial Security
A pattern we deploy repeatedly for Southern California campuses and multi-building portfolios:
| VLAN / segment | Typical devices | Notes |
|---|---|---|
| Camera / video | IP cameras, encoders, local NVRs | Highest bandwidth; often QoS-sensitive for live view |
| Access control | Controllers, PoE readers, some lock interfaces | Lower bandwidth; high availability for doors |
| Intercom / entry | Video intercoms, gate controllers | Real-time audio/video; isolate from guest Wi-Fi |
| Building / BMS (optional) | Sensors, limited IoT | Only if policy requires separation from security |
| Management | Jump hosts, admin workstations, out-of-band | Strict source restrictions |
Avoid one mega “IoT VLAN” that mixes cameras, printers, thermostats, and badge readers. That recreates a flat network with a prettier name.
Core Design Principles
1. Default deny between security and user networks
Cameras should not initiate sessions to finance servers. Workstations should not SSH into every NVR on the floor. Use firewall or Layer 3 ACL policy:
- Allow management hosts (or ZTNA brokers) to reach camera/access admin interfaces
- Allow cameras to reach VMS / VSaaS / NVR destinations only
- Allow access controllers outbound HTTPS (or vendor-specific ports) to cloud control planes
- Block east-west chatter between camera VLAN and access VLAN unless a specific integration needs it
2. Prefer outbound cloud models when the platform supports them
Platforms like Verkada, many Brivo / cloud access stacks, and modern VSaaS products often rely on outbound HTTPS rather than inbound port forwards. That reduces attack surface and fits zero-trust thinking: devices call home; you do not expose them to the internet.
3. Treat PoE as a first-class design constraint
Undersized PoE is one of the most common post-install failure modes. Budget:
- Per-port power (especially PTZ, multi-sensor, IR heaters, and powered readers)
- Per-switch and per-PSU totals with headroom for growth
- Spare ports in each IDF for future doors and cameras
- UPS runtime for PoE switches that keep doors and critical cameras alive during short outages
4. Align cabling with the security plan
Cat6 / Cat6A structured cabling, correct pathway design, and tested permanent links matter as much as the switch SKU. Long outdoor runs, inter-building fiber, and camera mounts without weather-rated terminations show up later as “mystery” drops—not as clean design choices.
Bandwidth and QoS for Video
Rough planning guidance (always validate against codec, resolution, FPS, and vendor datasheets):
- Estimate sustained bitrate per camera at the quality you actually record (not marketing maximums)
- Multiply by concurrent live-view sessions for ops centers
- Separate recording / uplink paths from general internet browsing
- Apply QoS so security video is not starved by backups or large file transfers
Cloud video platforms change the math: more traffic may leave the site toward the vendor cloud. Size WAN / SD-WAN accordingly for multi-site rollouts.
Firewall and Identity Checklist
Before go-live, document:
- FQDNs and IPs each vendor requires (and how often they change)
- DNS strategy for devices (trusted resolvers; avoid consumer DNS on security VLANs)
- Certificate / TLS expectations for cloud agents
- Admin access path: VPN, ZTNA, or jump host—never direct RDP/SSH from the internet to NVRs
- Logging: send firewall allows/denies and switch auth events to your SIEM where possible
If you are moving toward zero trust, physical security VLANs should be early candidates for least privilege and continuous monitoring—not afterthoughts.
Multi-Site Consistency Without Copy-Paste Chaos
For portfolios (retail, property management, distributed clinics):
- Standardize VLAN IDs and naming across sites where practical
- Use templates for switch configs (camera VLAN, access VLAN, uplink trunks)
- Keep a living matrix of vendor cloud destinations per platform
- Stage a pilot site, then replicate—do not invent a new topology per building
Common Mistakes We See
- Cameras on the same SSID or VLAN as guest Wi-Fi
- Flat Layer 2 between buildings “for convenience”
- Inbound NAT to NVRs “just for the integrator”
- No spare PoE for the next ten doors on the roadmap
- Access control and cameras sharing one VLAN with no ACL between them
- Skipping documentation so the next IT hire cannot tell which subnet is which
How This Fits SiriusPackets Deployments
When we design enterprise networking, structured cabling, wireless, surveillance, and access control together, VLAN and PoE plans are part of the same drawing set—not a punch-list item after cameras are hung. That is how you get stable Verkada / Axis / Brivo-class systems on networks that still pass an IT security review.
If you are planning a camera refresh, multi-site access control rollout, or campus re-cabling, start with segmentation and power budgets. The right VLAN design turns physical security into a controlled workload—not an unmanaged IoT risk.
Get a free quote if you want a site survey and a network design that matches your camera and door counts—not generic switch defaults.