A switch or multiple switches

[gabtrillz]

Hello everyone, I'm still thinking about how I'm going to do my installation, I hope you can help me with this question.

This is a new installation in a new building, I will need 18 cameras on the ground floor, and 18 cameras on the first floor. Maybe there are more, but I just want to get an idea of the configuration

Option 1. A 40-poe switch in the downstairs office, and all the cams connected there.

Option 2. A 20-poe switch in the office on the ground floor (for the 18 cams here), and a giga uplink for a second 20-poe switch, which would be at the electrical room on the first floor (for the 18 cams there)

Option 3. An small switch, for example 10 ports, all gig. And I make this conections:
2 cables for 2x 10poe-switches, in the same office and from there to the 18 cams.
2 cables for 2x 10poe-switches, in the electrical room on the first floor, for the 18 cameras on that floor.

Or maybe another better option?

I will appreciate all the opinions, thanks

 

[wittaj]

That is like asking which car manufacturer is better - strong opinions on which one.

Two schools of thought.

Get one professional grade switch and call it done.

Get multiple switches so if one goes down, the whole system isn't lost.

Personally I opt for more switches. The nay-sayers say that cost more to run in electricity and you can by one used professional grade switch for less than buying multiple switches, but I am of the mindset that everything breaks at some point, so I do not want the failure of the switch to bring down the whole system.

 

[sebastiantombs]

I'd use a 24 port switch on each floor. They would both need two, gigabit, uplink ports. Wherever the central network area is, simply link the two switches via the gig uplinks and from the additional gig port on that switch to the NVR/VMS/main network as applicable. 18 cameras will only actually use about 100-200Mb/ps, depending on resolution, bit and frame rates, for the gig links will not even come close to capacity.

 

[SpacemanSpiff]

...
Maybe there are more...

Lol.. its a matter of WHEN you'll add more... not IF

In addition to the advice already posted. 'Home runs' of cabling to a single location can, at times, be a pain even when on a single floor. At the least, establish a switch on each floor, and connect the two. Your options will most likely be directly affected by other networking & physical factors among other things. Length limitation of Ethernet of cabling, and the headaches of the building makeup that might result in having switches in multiple locations on one floor.

You mentioned it is a new building. Is it still under construction?

 

[user8963]

I highly recommend surge protection on new systems... if you have nothing and want to invest money and protect your investment , then you should add some security.

dahua sells a managed L2 POE switch , where each port has some surge protection. you can buy it from andy for a good price.

model is
PFS4218-16ET-190 (or -240, depends on your power needs)

PFS4218-16ET-190 | Dahua Technology - Dahua International

PFS4218, 16-Port PoE Switch

www.dahuasecurity.com

there is also a 24port version available

you need to proper ground the switch (!) and connect it to your home network via SFP port with fiber !
it may doesnt protect you from direct thunder strikes, but from most what can happen.

you only connect your outdoor network devices to it.

 

[gabtrillz]

That is like asking which car manufacturer is better - strong opinions on which one.

Two schools of thought.

Get one professional grade switch and call it done.

Get multiple switches so if one goes down, the whole system isn't lost.

Personally I opt for more switches. The nay-sayers say that cost more to run in electricity and you can by one used professional grade switch for less than buying multiple switches, but I am of the mindset that everything breaks at some point, so I do not want the failure of the switch to bring down the whole system.

Thanks for your answer, I also like more the idea of putting several switches, also because of the cables and the conduits. With one switch per floor, I would get 18 cables to the office, plus only one from the top floor. There is saving of cable and pipe. Otherwise I would get 36 cables to the office.

 

[gabtrillz]

I'd use a 24 port switch on each floor. They would both need two, gigabit, uplink ports. Wherever the central network area is, simply link the two switches via the gig uplinks and from the additional gig port on that switch to the NVR/VMS/main network as applicable. 18 cameras will only actually use about 100-200Mb/ps, depending on resolution, bit and frame rates, for the gig links will not even come close to capacity.

I like this idea.
What do you think if the central network is the same switch for the ground floor. I mean, the network would simply be a switch in the office, using one gig port for the BI computer, another gig port for the switch upstairs, and the rest of the ports for the cameras on this floor.

What would be the solution, if for example, downstairs I need more than 24 cameras in the future? add a little switch to this?

 

[gabtrillz]

Lol.. its a matter of WHEN you'll add more... not IF

In addition to the advice already posted. 'Home runs' of cabling to a single location can, at times, be a pain even when on a single floor. At the least, establish a switch on each floor, and connect the two. Your options will most likely be directly affected by other networking & physical factors among other things. Length limitation of Ethernet of cabling, and the headaches of the building makeup that might result in having switches in multiple locations on one floor.

You mentioned it is a new building. Is it still under construction?

My idea is to leave enough junction boxes on most walls in case I want to add more cameras.
That is, if in the future I want to add a new camera, I would only have to introduce a new conduit in that wall to reach the junction box, and from there I already have a conduit directly to the switch.

The building is still under construction.

 

[sebastiantombs]

I would not mix the camera and regular network traffic on the same switch to keep those two networks as separated as possible. I would use one IP range for the cameras, IE 192.168.10.xxx and anther IP range, IE 192.168.1.xxx, for the normal network. That serves to keep the cameras blocked from internet access for added security and prevents normal network users from directly accessing the cameras which can be another security problem.

In fact I'd have dual switches upstairs as well just for the purpose of network segregation and security. The number of ports on the second switch depends on the occupancy. Doing it this way is the simplest way to keep each network isolated from the other.

If you are proficient with IP protocol, everything can go on one switch for each floor. That would require layer 2, or 3, switches and VLANs to keep things segregated.

 

[gabtrillz]

I would not mix the camera and regular network traffic on the same switch to keep those two networks as separated as possible. I would use 0ne IP rang for the cameras, IE 192.168.10.xxx and anther IP range, IE 192.168.1.xxx, for the normal network. That serves to keep the cameras blocked from internet access for added security and prevents normal network users from directly accessing the cameras which can be another security problem.

In fact I'd have dual switches upstairs as well just for the purpose of network segregation and security. The number of ports on the second switch depends on the occupancy. Doing it this way is the simplest way to keep each network isolated from the other.

If you are proficient with IP protocol, everything can go on one switch for each floor. That would require layer 2, or 3, switches and VLANs to keep things segregated.

Yes, that's more or less the idea that I have, but I wanted to do it with physically different networks.

For the cameras:
-downstairs, in the office, the computer with blue iris, and a switch
-upstairs another switch.

For internet:
-downstairs, the router, with a switch, connected to a wifi AP.
-upstairs, a wifi AP connected to the downstairs switch.

 

[gabtrillz]

I'd use a 24 port switch on each floor. They would both need two, gigabit, uplink ports. Wherever the central network area is, simply link the two switches via the gig uplinks and from the additional gig port on that switch to the NVR/VMS/main network as applicable. 18 cameras will only actually use about 100-200Mb/ps, depending on resolution, bit and frame rates, for the gig links will not even come close to capacity.

Sorry I did not understand very well, you mean connecting the 2 switches to each other, and only one of them to the central network?

Wouldn't it be better for each switch to connect directly to the central network?

 

[sebastiantombs]

I those two switches are only handling camera traffic it is fine to connect them together. The bandwidth involved is not all that high. That's called "daisy chaining" and is a widely used practice. I am assuming that the Blue Iris machine will have two, or more, network ports. Putting all the camera data through the main router, ISP router, is not a good idea. Those routers are generally not built to handle the constant load that cameras produce, plus connecting through the router exposes the, potentially to the internet and local users which isn't a good idea at all.

 

[Teken]

Option 2 would be my recommendation as others noted for ease of installation, direct feed, and redundancy. Since this is a new install plan and invest for the future by choosing a POE+ (at) switch.

Makes little sense buying a POE (af) switch today given the entire market is headed toward more power hungry devices.

Lots of the smaller 24 port POE+ switches come in 250 / 500 watt flavours today so if finances aren’t an issue go with a 500 watt variant.

You’ll want to confirm whatever managed switch you choose supports layer 3 never mind VLAN’s. The more expensive hardware provide both (fibre optic) SFP (1GB) / SFP+ (10GB) ports.

It’s worth the extra money to have both and never ever have to worry about bandwidth issues. Connecting via fibre assures reliable high bandwidth not affected by RFI / EMI.

Which leads to the next important issue of running that security system on its own isolated network - not connected to the internet. Doing so out of the hole will avoid network congestion while ensuring security is at the forefront of this deployment.

As others noted the use of SPD’s and proper earth grounding is paramount from head end to end points. A UPS of sufficient capacity should be installed to offer no less than 60 minutes of runtime.

Edge recording at each camera should be used to provide a measure of redundancy in case of a NVR failure. As of this writing High Endurance Micro SD cards are the industry standard to be used.

A dedicated router & firewall appliance needs to be installed at the edge of the network along with antivirus scanner.

Good luck . . .

 

[gabtrillz]

I those two switches are only handling camera traffic it is fine to connect them together. The bandwidth involved is not all that high. That's called "daisy chaining" and is a widely used practice. I am assuming that the Blue Iris machine will have two, or more, network ports. Putting all the camera data through the main router, ISP router, is not a good idea. Those routers are generally not built to handle the constant load that cameras produce, plus connecting through the router exposes the, potentially to the internet and local users which isn't a good idea at all.

Ok cool.
I didn´t buy the Blue Iris machine yet, but I think it will have just 1 network port, directly contected to one of the switches.
This computer is going to be for 24/7 security only. Nothing more. No internet connection.

What do you think ?

 

[sebastiantombs]

That will work also but will deny you being able to access the BI system from anywhere else other than that PC. That can be a key factor when you're "out of the office" but does imply that you use a VPN connection, and inbound connection not an outbound designed to hide your internet habits. Adding a second network card isn't a difficult task, basically plug it into an open slot and follow the bouncing ball to configuure it, and uses very little additional power in the PC.

Here's a quick and dirty sketch. I'm not a big fan of WiFi, especially in a business environment, so APs are not my idea of a network.

 

[gabtrillz]

That will work also but will deny you being able to access the BI system from anywhere else other than that PC. That can be a key factor when you're "out of the office" but does imply that you use a VPN connection, and inbound connection not an outbound designed to hide your internet habits. Adding a second network card isn't a difficult task, basically plug it into an open slot and follow the bouncing ball to configuure it, and uses very little additional power in the PC.

Here's a quick and dirty sketch. I'm not a big fan of WiFi, especially in a business environment, so APs are not my idea of a network.

View attachment 109274

Thank you so much for your answer.

The wifi network is for the clients. The ground floor of the building is a restaurant, with its respective kitchen, storehouses and office in the back.
Then the first floor is a bar.

There is a third network that I need to create, a network for the cash registers, to synchronize the orders and the stock. And my idea was the same, a switch for all the cash registers and another computer in the office.

The cameras I would like to use are the Dahua 5442T-ASE or 5442T-ZE with the wall brackets.

At this point, what switch would you recommend for the cameras?

 

[gabtrillz]

Option 2 would be my recommendation as others noted for ease of installation, direct feed, and redundancy. Since this is a new install plan and invest for the future by choosing a POE+ (at) switch.

Makes little sense buying a POE (af) switch today given the entire market is headed toward more power hungry devices.

Lots of the smaller 24 port POE+ switches come in 250 / 500 watt flavours today so if finances aren’t an issue go with a 500 watt variant.

You’ll want to confirm whatever managed switch you choose supports layer 3 never mind VLAN’s. The more expensive hardware provide both (fibre optic) SFP (1GB) / SFP+ (10GB) ports.

It’s worth the extra money to have both and never ever have to worry about bandwidth issues. Connecting via fibre assures reliable high bandwidth not affected by RFI / EMI.

Which leads to the next important issue of running that security system on its own isolated network - not connected to the internet. Doing so out of the hole will avoid network congestion while ensuring security is at the forefront of this deployment.

As others noted the use of SPD’s and proper earth grounding is paramount from head end to end points. A UPS of sufficient capacity should be installed to offer no less than 60 minutes of runtime.

Edge recording at each camera should be used to provide a measure of redundancy in case of a NVR failure. As of this writing High Endurance Micro SD cards are the industry standard to be used.

A dedicated router & firewall appliance needs to be installed at the edge of the network along with antivirus scanner.

Good luck . . .

Thank you for all the info.

About the poe + switch, what would be your simplest recommendation?

For an isolated network, is a managed switch with layer 3 necessary?

About the SPD and grounding do you mean the power plugs of the switches. Or do you mean to use STP network cable ?

 

[sebastiantombs]

If the cameras are on their own physical network there is no need for managed switches.

As far as which ones to choose all I can say is don't cheap out. Buy quality switches with real power supplies, not low priced with cheap switching power supplies. I'm using IPCamPower switches and they can be bought from Nellys Security, a vendor and IPCT member. Unfortunately the chip shortages have also effected switches and they can be hard to find. An alternative is to look on eBay for used commercial/business class switches. Generally they will be layer 2 or 3 switches but when defaulted back to "factory" will just act like a plain old dumb switch.

 

[gabtrillz]

If the cameras are on their own physical network there is no need for managed switches.

As far as which ones to choose all I can say is don't cheap out. Buy quality switches with real power supplies, not low priced with cheap switching power supplies. I'm using IPCamPower switches and they can be bought from Nellys Security, a vendor and IPCT member. Unfortunately the chip shortages have also effected switches and they can be hard to find. An alternative is to look on eBay for used commercial/business class switches. Generally they will be layer 2 or 3 switches but when defaulted back to "factory" will just act like a plain old dumb switch.

Perfect, thank you very much for everything.

 

[Teken]

Thank you for all the info.

About the poe + switch, what would be your simplest recommendation?

For an isolated network, is a managed switch with layer 3 necessary?

About the SPD and grounding do you mean the power plugs of the switches. Or do you mean to use STP network cable ?

POE Switch: This really comes down to if you have past experience with Enterprise hardware vs consumer grade. Price, features, noise, energy consumption, usually drives that decision. In the Tier 1 realm its going to be Cisco, Juniper, HP, Lenovo, IBM, Aruba, Brocade, Dell / EMC, etc.

There are lots of Tier 2 companies that span Microtik, Ubiquiti, TrendNet, Netgear.

In the Tier 2 realm I like and use Ubiquiti Edge Switches which incorporates VLAN / Layer 3 routing others like the UniFi line from Ubiquiti as it offers ease use and integration with their own ecosystem.

Layer 3: A layer 2 switch is fine in a SMB environment like a restaurant / bar. A layer switch 3 provides Fast Switching using dedicated ASIC hardware chips to (forward) routing for Ethernet ports. A router uses software to perform the same (forwarding) or routing vs dedicated hardware. A router can route ethernet, serial, ISDN, and provides features not normally associated with a switch like NAT, IPSEC, Tunneling, Firewall, and services like VPN etc.

Surge Protective Device / TVSS: SPD's should always be installed and deployed in a tiered fashion. Type 1 SPD are installed at the service (meter) entrance. Type 2 SPD's are installed at the service (breaker) panel. Type 3 SPD's are known as Point of Use at the outlet such as surge outlets, surge bars, AVR, UPS. Type 4 SPD's are installed in line before the electrical load such as a washer, dryer, furnace, dishwasher, etc.

You may consider the following brands APC, Eaton, Ditek, CyberPower, Leviton, Siemens, Tripp Lite, Panamax, Hubel, etc.

Grounding: The cornerstone and success of any SPD / TVSS protection system hinges upon the electrical system having a low resistance earth ground below 25 ohms. Whatever the SPD / TVSS can not absorb (sacrifice itself) the rest will be shunted to earth ground via the buildings wiring. Any hardware that has a grounding point on the chassis needs to be grounded to the same single point earth ground.

In a typical business environment like a restaurant / bar installed in a closet as you suggest the only ground will come from the electrical outlet.

Power: All of the equipment should be powered by 20 amp dedicated circuit(s). When the electrician installs (2) four gang outlets in the service closet each should be on the opposite side of the single split phase electrical system. If one leg drops out the other will continue to operate fine. Regardless of that basic thing at hand a AVR UPS must be in service to protect the very expensive and important hardware from voltage sags (brown outs) and micro surge / spikes.

Dirty power is one of the five major contributors of short service life and erratic behavior and damage to electronics.

Cooling / Venting: Serious consideration about how to monitor and cool / vent the service closet needs to be planned and in place. As noted up above dirty power is one of the major killers besides - heat. The installation environment dictates what needs to be done so if its in the cold ass wine cellar that's not a huge issue.

The same isn't true if the service closet is on the same South Facing wall in AZ, CA, TX etc!

This is where reviewing the operating temperature of each device is critical to long term reliability. You won't see a tier 3 X brand show you real test of MTBF or have realistic operating ranges that make sense.

Energy: The client is going to have to pay two bills one for the initial outlay for the purchase. The other is 24.7.365 until the device finally dies so make sure the hardware is as efficient as possible.

Noise: Noise may not be an issue in your location but if it is you better read how many dB's that switch puts out. In a bar nobody cares because the music will always drown it out. In a quiet office environment where people are in a clerical data entry environment that may be hard to endure hearing a jet plane for 8 hours a day.