A separate camera network can make it clearer which devices may reach each other. Simply setting a different network name is not sufficient for that purpose. Start with the connections that are necessary for recording, viewing, maintenance, and time synchronization.
Describe which recorder the cameras use and from which workstations people are allowed to view. Also note maintenance, time synchronization, and any remote services. This forms the basis for targeted access. A general wish to “separate” cameras does not yet indicate which functions should remain available.
The available switches and router determine what capabilities are available. A VLAN can be part of the configuration, but access rules also determine what between networks is allowed. Let the configuration align with the existing management, so that no second unknown network structure arises alongside it.
Document who is responsible for camera settings and who manages network rules. Give users only the access that is appropriate for their task, as long as the equipment supports this. Store the management data in the agreed location and describe how access is revoked upon departure of a staff member.
Check whether the recorder can record and the authorized workstation can view back. Additionally, verify whether a workstation without permission can indeed not approach the cameras. Only a working app does not prove that the intended separation has been achieved.
Document ports, network segments, and exceptions. Agree on how a future camera will be added and how a malfunction will be reported. If someone later moves a cable to another switch port, it must be clear what consequences that could have for reachability and access.
No. The allowed connections, management settings and checks are part of the setup.
This must be taken into account in the design and tested after the change. Network separation should not unintentionally block necessary functions.
