Security network design

Most security systems are specified by people who understand cameras and doors, then installed onto a network designed by nobody in particular. It works on day one because the load is low and the estate is small, and it degrades as both grow. I design the network underneath the systems, and I design it for what security traffic actually does rather than for what office traffic does.

Why security traffic is different

• It is constant. Video does not have a quiet period. A network sized on average office utilisation is sized wrong.
• It is sensitive to loss in ways users notice later. Dropped frames do not generate a help desk ticket. They generate a missing incident three months from now.
• Multicast behaves badly by default. Without querier and snooping configured deliberately, video floods where it should not and starves what should get it.
• Devices are powered by the network. PoE budget, not port count, is the real constraint, and it is the calculation most often skipped.
• The endpoints are untrustworthy. Cameras and controllers are embedded devices with long patch cycles sitting in publicly reachable locations.

What the design covers

• Segmentation. Where security sits relative to corporate, OT and guest, what crosses the boundary, and what enforces it. Separation that survives someone plugging a laptop into a camera drop.
• VLAN and addressing plan. Structured so it can grow, and documented so the next person can read it.
• Routing and multicast. Including querier placement and snooping, which is where multi-site video deployments most reliably come apart.
• Switch selection and sizing. Against PoE draw, uplink capacity and stacking, not against port count alone.
• Redundancy. Link and device level, sized to what actually needs to survive rather than to everything.
• QoS. Where it earns its complexity and where it does not.
• Device hardening posture. What the network does about endpoints that cannot defend themselves.

Platforms

Cisco Catalyst and IOS-XE, HPE Aruba CX and Instant, Juniper EX and Junos, Alcatel-Lucent OmniSwitch, Fortinet, and the usual mixed estates that grew rather than being designed. Vendor selection follows the requirement rather than the other way round, since there is nothing here I earn a margin on.

Who this is for

• Anyone putting cameras, readers or controllers onto a network at scale.
• Multi-site owners where each location was built differently and none of them agree.
• Organisations where IT and physical security have never had to share infrastructure and now do.
• Projects where the security design is finished and nobody has designed the network yet.

Related