The Truth about VLANs

The Truth about VLANs

What security integrators need to know

The Truth about VLANsA common misperception among security system integrators is the notion that an IP surveillance network must be separate and distinct from corporate or campus data, and the voice network. However, having a separate, distinct network for video surveillance comes with a price. Not only do costs increase for physical resources, such as cabling and networking equipment, but the complexity of managing and maintaining two different networks rises significantly. Nevertheless, integrators assume that having separate networks is the only way to achieve two important requirements:

  1. Security: Only authorized users physically connected to the network will have access to video surveillance traffic, and unwanted users will be kept out.
  2. Bandwidth Availability: A dedicated network ensures bandwidth will always be reserved for the surveillance traffic, as needed. Security integrators are often not aware that these same security and bandwidth requirements can be realized on one common network by using VLAN technology.

Whether new to networking, or just unsure about the value of VLANs, these FAQs may help clarify some confusion, giving confidence to take advantage of this useful technology in future IP, surveillance, network deployments.

What is a VLAN?

To understand VLAN, it’s important to know about LAN or Local Area Network.

LAN is a data communications system, allowing a number of computers to communicate directly with each other within a moderately-sized, geographic area over a physical network.

Basically, a VLAN is a “virtual” LAN, consisting of a subset of devices communicating privately on a larger network. In more technical terms, a VLAN is a unique, broadcast domain created by smart and managed Ethernet switches. (Unmanaged switches cannot be used to create VLANs, as they do not have a user interface to facilitate this technology).

Since this is a logical segmentation, not a physical one, devices on the same VLAN do not have to be physically located together.

What are the benefits of VLANs?

VLANs support the logical grouping of network devices, reduce broadcast traffic and allow more control when implementing security policies.

How do VLANs provide security?

VLANs limit the ability for any device to hear anything on other Virtual Local Area Networks. On a corporate network, for example, VLANs are often used for virtual workgroups because they make it easier to place geographically-dispersed members together.

A VLAN will logically separate and isolate certain traffic from other traffic on the network, whether it’s data, voice or other. For this reason, VLANs are ideal for overlaying IP surveillance video traffic on an existing data network.

Because surveillance data can be sensitive, network administrators don’t want it accessible across the entire network, so placing only those users who need access to that video data on a VLAN can reduce the chances of an outsider gaining access.

What is QoS?

Quality of Service (QoS) is the ability to provide different priority to different applications, users or data flows, or to guarantee a certain level of performance to a data flow.

For example, a required bit rate or delay measurement may be guaranteed, making QoS important if the network capacity is potentially insufficient, especially for real-time, streaming, multimedia applications, such as voice over IP and surveillance video.

Without QoS, if a corporate data network experiences a heavy traffic event caused by mass file transfers, broadcast storms or other such applications, the surveillance video may freeze, skip or even drop out completely. For many who consider surveillance video to be mission-critical, this risk is unacceptable.

VLANs allow QoS measures to be taken on devices otherwise fighting for shared bandwidth. When using VLANs, the network administrator can assign a different QoS to different VLANs, prioritizing certain traffic types over others.

What is a broadcast?

A broadcast is an Ethernet message sent by one device to all other devices on the LAN that are used in a variety of background tasks operating in an Ethernet network, such as an ARP request. When an Ethernet switch receives a broadcast message, it floods to all other ports.

In a large network, uncontrolled broadcasts can impact overall network performance because, anytime a device is listening to a broadcast, it dedicates resources that could otherwise be used to process higher-priority information.

Just as Ethernet switches isolate and create separate collision domains, VLANs isolate and create separate broadcast domains, helping to reduce network traffic since broadcasts are contained within the VLAN. Devices on other VLANs will not hear these broadcasts, which reduce traffic and increase network performance.

How are VLANs set up?

Configuring a VLAN is usually done through the switch’s user interface by associating a group of ports together, forming a VLAN membership.

Consider the following example using a 24-port, Ethernet switch, 10 IP cameras and 10 PCs:

  • Ports 1-10 are connected to 10 IP cameras for surveillance.
  • Ports 11-20 are connected to 10 PCs for employee Internet access.
  • Port 24 is the “uplink” port and sends the surveillance and

Internet traffic to another VLAN switch further upstream. Using the switch’s UI, the network administrator would associate ports 1-10 and 24 with VLAN 100. Ports 1-10 would be designated as “untagged,” while port 24 would be designated as “tagged.”

The network administrator would create a second VLAN by associating ports 11-20 and 24 with VLAN 200. Similarly, ports 11-20 would be designated as “untagged,” while port 24 would be designated as “tagged.”

Is there a solution to being intimidated by the thought of configuring a VLAN?

Yes. Embedded into select D-Link switches, an Auto Surveillance VLAN can automate the configuration, making networking expertise a non-requirement.

How does Auto Surveillance VLAN technology help?

This technology automatically detects network-attached, surveillance devices, such as IP cameras and NVRs, and creates a separate VLAN that separates data traffic from surveillance network traffic.

QoS is also set to “high-priority,” above other network traffic, allowing surveillance video to stream smoothly, reliably, securely and promptly, even when the data network is experiencing heavy traffic. This automatic, built-in feature is a welcome change from conventional systems that typically requires each setting to be manually configured and added to the network one-by-one.

What’s the difference between Auto Surveillance VLAN and Auto Voice VLAN?

D-Link’s Auto Surveillance VLAN detects surveillance devices while Auto Voice VLAN detects voice devices attached to the network and automatically creates a high-priority VLAN for both. Who benefits from Auto Surveillance VLAN technology?

Operations that need:

  • a cost-effective way to consolidate video surveillance and data network(s);
  • a reliable IP surveillance system with good video quality and manageability features; and
  • the flexibility to add IP cameras to surveillance system(s), as well as upgrade and move the cameras, without reconfiguring the surveillance network.

Putting it All Together

There are significant benefits achieved by using VLANs in surveillance networks. Because VLANs support a logical grouping of network devices, they reduce broadcast traffic and allow more control in implementing security policies. Also, surveillance traffic is only available to those authorized, and bandwidth is always available, when needed.

This article originally appeared in the August 2013 issue of Security Today.

Featured

  • It's Show Time

    I am one of those people that likes to see things get bigger and better. As advertised, ISC West is going to be bigger (more exhibitors) and better (more attendees). It’s show time in Las Vegas. Read Now

    • Industry Events
    • ISC West
  • SIA Releases New Report on Operational Security Technology

    The Security Industry Association (SIA) has released an impactful new resource – Operational Security Technology: Principles, Challenges and Achieving Mission-Critical Outcomes Leveraging OST. Read Now

  • Cyber Overconfidence Is Leaving Your Organization Vulnerable

    The increased sophistication of cyber threats pumped by the relentless use of AI and machine learning brings forth record-breaking statistics. Cyberattacks grew 44% YoY in 2024, with a weekly average of 1,673 cyberattacks per organization. While organizations up their security game to help thwart these attacks, a critical question remains: Can employees identify a threat when they come across one? A Confidence Gap survey reveals that 86% of employees feel confident in their ability to identify phishing attempts. But things are not as rosy as they appear; the more significant part of the report finds this confidence misplaced. Read Now

  • Mission 500 Debuts Refreshed Identity Ahead of Security 5K/2K at ISC West

    Mission 500, the security industry’s nonprofit charity dedicated to supporting children in need across the US, Canada, and Puerto Rico, has unveiled a refreshed brand identity ahead of ISC West. The charity’s new look includes a modernized logo with refined messaging to reinforce Mission 500’s nearly decade-long commitment to serving the needs of children and families in crisis. Read Now

    • Industry Events

New Products

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.