Designing a CCTV Network: Topology, IP Plan and Where the Switches Go

Most camera networks are designed camera-first and switch-last, which is why they end up with a flat VLAN, one oversized core switch and an uplink that saturates during a video export. Building it the other way — cabinets, then uplinks, then cameras — produces a network that is cheaper to build and far easier to troubleshoot.

1. Start with physical zones, not device counts

Divide the site into zones: a building, a floor, a perimeter segment, a car park. Each zone gets one cabinet, and one switch per cabinet up to the point where port count or cable length forces a second. This is the layout that survives expansion, because adding cameras means adding a switch in a zone you already understand.

• Keep every run under 100 m; a zone boundary is usually a cable-length boundary.
• Size the cabinet for the next phase — 8 ports now often means 16 in two years.
• Put the NVR / VMS head-end where the video actually lands, not where the cameras are.

2. Size the uplink from video, not from habit

Each camera stream is roughly constant. Multiply per-camera bitrate by camera count, add 20–30% for bursts and management traffic, and that is your uplink requirement — not a wish list.

The table is what decides whether a cabinet uplinks on 1G copper, 2.5G, or 10G fibre. Two 1G uplinks in a LAG give you redundancy as well as bandwidth; one 10G uplink gives you headroom without a second fibre pair.

That is the practical difference between the gigabit switch range, the 2.5G range and the 10G switches — uplink capacity is what you are buying at the top of the range.

3. Plan addresses and VLANs before the first cable

A camera network needs very few address classes, but it needs them fixed. Typical scheme for a mid-size site:

• Reserve the first 50 addresses per cabinet for infrastructure — switches, PDUs, future devices.
• Number cameras by zone and position, so a camera's address tells an engineer where it is.
• Keep management on its own VLAN; camera ports should not be able to reach switch logins.
• One flat network is faster to install and much slower to diagnose — see our note on VLAN segmentation.

4. Place PoE budget by zone, not by total

A common failure is a single large PoE switch at the head end feeding cameras through long runs and pass-through patch panels. Zone-based PoE keeps runs short, keeps the load small enough for a fanless switch, and means one cabinet failing does not blind the whole site.

• Size each cabinet's PoE budget to its own cameras plus 25–30% night headroom.
• Keep at least two spare PoE ports per cabinet for the cameras added after handover.
• If a zone has fewer than four cameras, a small fanless switch beats a long cable run.

5. The five checks before the design is signed off

• Every camera run is under 100 m as installed, not as drawn.
• Every cabinet uplink has capacity for its cameras plus 30%.
• PoE budget per cabinet covers night draw plus headroom.
• IP plan and VLANs are documented per cabinet, with spares reserved.
• At least one path between any camera and the NVR survives a single link failure.

Send us a site plan with camera positions and we will return a cabinet-by-cabinet switch and uplink schedule. Ask for a quote.

FAQ

Les spécifications techniques détaillées sont fournies en anglais.