How to setup VLANs for new security cameras on existing Catalyst 3560s and 3845 Router

[erikahess]

Forgive me as I am not an expert.  I have 3 Catalyst 3560s (a MB, GB, and X) and a 3845 router.   I have 6 new security cameras (IP) that will be added to the network next week.  I do not have any separate VLANs setup right now and know I should get another VLAN setup for the cameras.  I know the Catalyst 3560s are layer 3 devices, but I also have a router.  What is the best way to setup the routing?  On the router or the switches?  I don't have the router connected directly to each switch right now nor do I have the switch ports avaiblale on the router to directly connect each switch to it.  I have a 3560x in building b, a 3560G and the 3560MB building a.  Building b and building a are connected by fiber through a HP Procurve swtich at building b and the 3560G in building a.  The HP Procurve is connected to the 3560X in building b with fiber.   

The 6 cameras will be connected to the 3560 MB switch.

I have another security camera connected to the 3560X switch in building b.

The NVR server is on the 3560X switch in building b.

How do I setup the VLAN to add my security cameras? 

[Reza Sharifi]

You would need to put these cameras in a different subnet/vlan, because they require you to turn on multicast.

From your description, it seems that all your switches are currently connected to the HP switch.  Is the HP switch connected to the 3845 router? If yes then your route point is located on the router?

can you provide a diagram of your current network?

HTH

[erikahess]

I understand I need to add the cameras to a new subnet and vlan.  I have the subnet ready, but need to determine how to setup the VLAN and routing.  I don't know if the server will need to be on the same VLAN too?  Will it?  This is where all the cameras will store the recordings. 

The HP switch isn't directly connected to the router, but it is on the same LAN.  Right now everything is on one subnet on the LAN.  The cameras will be the first new subnet on a new VLAN on the LAN.  I'm working on a diagram now.

[Ven Taylor]

Diagram would definitley help.

Also, can your HP switch support trunking?

Two vlans means you're most likely going to have to trunk your vlans.

Make sure your drawing includes the cameras and the DVR or whatever your cameras home into.

Ven

[erikahess]

Yes, my HP switch can support trunking. 

[erikahess]

The text on the drawing:

Right now all the same subnet.  The Cisco 3845 does have an interface to another building on my WAN, so it’s routing to another subnet. 

The Sony DH-120s ad DH-140 are not on the network yet.  I want to setup a separate VLAN for them. 

[Reza Sharifi]

Ok, so I assume the default gateway for all your current devices is your WAN router (Cisco 3845).  Now, you can create a new vlan for all 6 cameras on the 3560GB, add the vlan to the trunk on the 3560GB Then on the 3845 you need to create a Sub-interface and trunk it twards the 3560G.  You also need to add the IP address to the sub-interface on the 3845.

3560GB

config t

vlan 20

name ip camera vlan

add the physical ports that the cameras are connected to to vlan 20

example

interface FastEthernetx/xx
 description camera-1
 switchport access vlan 20
 switchport mode access
 no ip address
 spanning-tree portfast

you then need to add this vlan to the trun port on the 3560

on the 3845

example

interface ge0/0.20

encapsulation dot1q 20

ip address 192.168.0.1 255.255.255.0

HTH

[erikahess]

You are correct, my default gateway is the 3845 WAN router.  I thought that my new VLAN, since it's a different subnet would have a different default gateway.

Does it matter that my cameras will actually be connected to the 3560 MB? 

[Reza Sharifi]

That is correct, you will need a new subnet and new vlan for the cameras.

for example

camera-1

ip address 192.168.1.10 255.255.255.0

default gateway 192.168.1.1 (this is the 3845 interface address)

HTH

[erikahess]

HTH:  I understand what you are saying now.  Thanks!  I will work on implementing this. 

[erikahess]

I have a question.  Do I create VLAN 20 on the MB switch also since that's where the cameras will be connected to the MB switchports and not the GB?  

[Reza Sharifi]

Yes, create vlan 20 on the MB switch, and then add it to the trunk that connects to the GB switch

[erikahess]

I setup this code on the VLAN on the 3560GB and added the interface to it that connected the 3560GB to the 3560MB.  However, when I ran the spanning-tree portfast command, I got this warning.  I do have the interface configured as a trunk. 

Warning: portfast should only be enabled on ports connected to a single

host. Connecting hubs, concentrators, switches, bridges, etc... to this

interface  when portfast is enabled, can cause temporary bridging loops.

Use with CAUTION

%Portfast has been configured on GigabitEthernet0/48 but will only

have effect when the interface is in a non-trunking mode.

[Ven Taylor]

do this to the interface configuration just to be safe:

!

no spanning-tree portfast

!

Ven

[erikahess]

I have added the router config and the swtich config to the GB and MB switches.  I want to get the GB and MB switches configured and tested before going forward with the HP switch.  I didn't add any new ip routes into the router.  Do I need to?  I can ping the IP cameras without having added a new ip route.  I've created VLAN 20 on the HP but that's it so far. 

On the MB switch I simply added the VLAN and assigned the ports to it.  I did check the VTP states, the VTP state of the MB switch is transparent and the VTP state of the GB switch is server.