Showing results for 
Search instead for 
Did you mean: 

How to setup VLANs for new security cameras on existing Catalyst 3560s and 3845 Router


Forgive me as I am not an expert.  I have 3 Catalyst 3560s (a MB, GB, and X) and a 3845 router.   I have 6 new security cameras (IP) that will be added to the network next week.  I do not have any separate VLANs setup right now and know I should get another VLAN setup for the cameras.  I know the Catalyst 3560s are layer 3 devices, but I also have a router.  What is the best way to setup the routing?  On the router or the switches?  I don't have the router connected directly to each switch right now nor do I have the switch ports avaiblale on the router to directly connect each switch to it.  I have a 3560x in building b, a 3560G and the 3560MB building a.  Building b and building a are connected by fiber through a HP Procurve swtich at building b and the 3560G in building a.  The HP Procurve is connected to the 3560X in building b with fiber.   

The 6 cameras will be connected to the 3560 MB switch.

I have another security camera connected to the 3560X switch in building b.

The NVR server is on the 3560X switch in building b.

How do I setup the VLAN to add my security cameras? 

2 Accepted Solutions

Accepted Solutions

I've attached a txt document based on your config.

View solution in original post

But what about your vlan1??

You should configured it like you did for vlan 20.

interface GigabitEthernet0/0.1

encapsulation dot1q 1

ip address

make sure u do a no shut under interface Gi0/0.

Have you checked the config i sent you?



View solution in original post

36 Replies 36

Reza Sharifi
Hall of Fame Master Hall of Fame Master
Hall of Fame Master

You would need to put these cameras in a different subnet/vlan, because they require you to turn on multicast.

From your description, it seems that all your switches are currently connected to the HP switch.  Is the HP switch connected to the 3845 router? If yes then your route point is located on the router?

can you provide a diagram of your current network?


I understand I need to add the cameras to a new subnet and vlan.  I have the subnet ready, but need to determine how to setup the VLAN and routing.  I don't know if the server will need to be on the same VLAN too?  Will it?  This is where all the cameras will store the recordings. 

The HP switch isn't directly connected to the router, but it is on the same LAN.  Right now everything is on one subnet on the LAN.  The cameras will be the first new subnet on a new VLAN on the LAN.  I'm working on a diagram now.

Diagram would definitley help.

Also, can your HP switch support trunking?

Two vlans means you're most likely going to have to trunk your vlans.

Make sure your drawing includes the cameras and the DVR or whatever your cameras home into.


Ven Taylor

Yes, my HP switch can support trunking. 

The text on the drawing:

Right now all the same subnet.  The Cisco 3845 does have an interface to another building on my WAN, so it’s routing to another subnet. 

The Sony DH-120s ad DH-140 are not on the network yet.  I want to setup a separate VLAN for them. 

Ok, so I assume the default gateway for all your current devices is your WAN router (Cisco 3845).  Now, you can create a new vlan for all 6 cameras on the 3560GB, add the vlan to the trunk on the 3560GB Then on the 3845 you need to create a Sub-interface and trunk it twards the 3560G.  You also need to add the IP address to the sub-interface on the 3845.


config t

vlan 20

name ip camera vlan

add the physical ports that the cameras are connected to to vlan 20


interface FastEthernetx/xx
 description camera-1
switchport access vlan 20 switchport mode access no ip address spanning-tree portfast

you then need to add this vlan to the trun port on the 3560

on the 3845


interface ge0/0.20

encapsulation dot1q 20

ip address


You are correct, my default gateway is the 3845 WAN router.  I thought that my new VLAN, since it's a different subnet would have a different default gateway.

Does it matter that my cameras will actually be connected to the 3560 MB? 

That is correct, you will need a new subnet and new vlan for the cameras.

for example


ip address

default gateway (this is the 3845 interface address)


HTH:  I understand what you are saying now.  Thanks!  I will work on implementing this. 

I have a question.  Do I create VLAN 20 on the MB switch also since that's where the cameras will be connected to the MB switchports and not the GB?  

Yes, create vlan 20 on the MB switch, and then add it to the trunk that connects to the GB switch

I setup this code on the VLAN on the 3560GB and added the interface to it that connected the 3560GB to the 3560MB.  However, when I ran the spanning-tree portfast command, I got this warning.  I do have the interface configured as a trunk. 

Warning: portfast should only be enabled on ports connected to a single

host. Connecting hubs, concentrators, switches, bridges, etc... to this

interface  when portfast is enabled, can cause temporary bridging loops.

Use with CAUTION

%Portfast has been configured on GigabitEthernet0/48 but will only

have effect when the interface is in a non-trunking mode.

do this to the interface configuration just to be safe:


no spanning-tree portfast



Ven Taylor

I have added the router config and the swtich config to the GB and MB switches.  I want to get the GB and MB switches configured and tested before going forward with the HP switch.  I didn't add any new ip routes into the router.  Do I need to?  I can ping the IP cameras without having added a new ip route.  I've created VLAN 20 on the HP but that's it so far. 

On the MB switch I simply added the VLAN and assigned the ports to it.  I did check the VTP states, the VTP state of the MB switch is transparent and the VTP state of the GB switch is server. 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers