Enterprise CCTV IP Addressing & VLAN Design with Cisco Catalyst C9300X-24Y

Complete Enterprise Guide for 300 Hikvision IP Cameras

Series: Enterprise CCTV Networking with Cisco & Hikvision
Level: Beginner to Advanced

---

Introduction

A well-planned IP addressing and VLAN design is the foundation of a reliable Enterprise CCTV network. Without proper planning, administrators may encounter:

• IP address conflicts
• Broadcast storms
• Slow network performance
• Difficult troubleshooting
• Security vulnerabilities

In this tutorial, you'll learn how to design a professional IP addressing scheme and VLAN architecture for a 9-floor building with 300 Hikvision IP cameras, using a Cisco Catalyst C9300X-24Y Core Switch.

---

Enterprise CCTV Network Topology

                    300 Hikvision Cameras
                             │
                          CAT6 Cable
                             │
                9 × 48-Port PoE Switches
                             │
                      SFP Fiber Modules
                             │
                     Single Mode Fiber
                             │
                      Main Fiber ODF
                             │
          Cisco Catalyst C9300X-24Y Core Switch
                             │
                  24-Port Gigabit Switch
                             │
      ┌──────────────┬──────────────┬──────────────┐
      │              │              │
   5 Hikvision NVRs  Management PC  Video Wall

---

Why Use VLANs?

A VLAN (Virtual Local Area Network) separates network traffic into logical groups.

Benefits

• Improved security
• Better performance
• Reduced broadcast traffic
• Easier troubleshooting
• Simplified expansion
• Better traffic management

---

Enterprise VLAN Design

VLAN ID	Department	Network
101	Floor 1 Cameras	192.168.101.0/24
102	Floor 2 Cameras	192.168.102.0/24
103	Floor 3 Cameras	192.168.103.0/24
104	Floor 4 Cameras	192.168.104.0/24
105	Floor 5 Cameras	192.168.105.0/24
106	Floor 6 Cameras	192.168.106.0/24
107	Floor 7 Cameras	192.168.107.0/24
108	Floor 8 Cameras	192.168.108.0/24
109	Floor 9 Cameras	192.168.109.0/24
200	NVR Network	192.168.200.0/24
300	Management	192.168.300.0/24

---

VLAN Diagram

              Cisco Catalyst C9300X
                      │
     ┌────────────────┼────────────────┐
     │                │                │
 VLAN 101         VLAN 102         VLAN 103
 Floor 1          Floor 2          Floor 3

     │                │                │

 PoE Switch      PoE Switch      PoE Switch

     │                │                │

30 Cameras      30 Cameras      30 Cameras

Continue the same design for Floors 4–9.

---

IP Addressing Strategy

Each floor receives its own subnet.

Floor 1

Device	IP Address
Gateway	192.168.101.1
Switch	192.168.101.2
Camera 1	192.168.101.11
Camera 2	192.168.101.12
Camera 3	192.168.101.13
...	...
Camera 30	192.168.101.40

---

Floor 2

Device	IP
Gateway	192.168.102.1
Switch	192.168.102.2
Camera 1	192.168.102.11
Camera 30	192.168.102.40

Continue this pattern through Floor 9.

---

NVR IP Address Plan

Device	IP
NVR-1	192.168.200.10
NVR-2	192.168.200.11
NVR-3	192.168.200.12
NVR-4	192.168.200.13
NVR-5	192.168.200.14

---

Cisco Core Switch

Device	IP
Core Switch	192.168.300.1

---

Monitoring Switch

Device	IP
24-Port Switch	192.168.300.2

---

Access Switch IP Plan

Floor	Switch IP
Floor 1	192.168.101.2
Floor 2	192.168.102.2
Floor 3	192.168.103.2
Floor 4	192.168.104.2
Floor 5	192.168.105.2
Floor 6	192.168.106.2
Floor 7	192.168.107.2
Floor 8	192.168.108.2
Floor 9	192.168.109.2

---

Cisco VLAN Configuration

configure terminal

vlan 101
 name FLOOR1

vlan 102
 name FLOOR2

vlan 103
 name FLOOR3

vlan 104
 name FLOOR4

vlan 105
 name FLOOR5

vlan 106
 name FLOOR6

vlan 107
 name FLOOR7

vlan 108
 name FLOOR8

vlan 109
 name FLOOR9

vlan 200
 name NVR

vlan 300
 name MANAGEMENT

end

---

Configure VLAN Interfaces (SVIs)

interface Vlan101
 ip address 192.168.101.1 255.255.255.0
 no shutdown

interface Vlan102
 ip address 192.168.102.1 255.255.255.0
 no shutdown

interface Vlan200
 ip address 192.168.200.1 255.255.255.0
 no shutdown

interface Vlan300
 ip address 192.168.300.1 255.255.255.0
 no shutdown

Repeat for VLANs 103–109.

---

Enable Layer 3 Routing

configure terminal

ip routing

This allows communication between authorized VLANs, such as NVRs accessing cameras.

---

Configure Trunk Ports

interface TwentyFiveGigE1/1/1

description Floor1 Fiber

switchport mode trunk

switchport trunk allowed vlan 101

no shutdown

Repeat for each floor's uplink.

---

Camera Naming Convention

Use meaningful names that identify the floor and location.

Camera	Name
Camera 1	F1-Entrance-01
Camera 2	F1-Lobby-02
Camera 3	F1-Corridor-03
Camera 4	F2-Office-01
Camera 5	F5-Lift-02
Camera 6	F9-Parking-05

Benefits:

• Faster troubleshooting
• Easier playback searches
• Better maintenance documentation

---

DHCP vs Static IP

Feature	Static IP	DHCP
IP Cameras	✅ Recommended	❌ Not Recommended
NVRs	✅ Recommended	❌ Not Recommended
Switches	✅ Recommended	❌ Not Recommended
Technician Laptop	Optional	✅ Suitable

Enterprise CCTV systems should use static IP addresses for all infrastructure devices.

---

Security Best Practices

• Place cameras in dedicated VLANs.
• Separate management devices from camera traffic.
• Restrict inter-VLAN access with ACLs where appropriate.
• Change all default passwords.
• Disable unused switch ports.
• Use secure remote management (SSH instead of Telnet).
• Back up switch and NVR configurations regularly.

---

IP Address Summary

Network	Purpose
192.168.101.0/24	Floor 1 Cameras
192.168.102.0/24	Floor 2 Cameras
192.168.103.0/24	Floor 3 Cameras
192.168.104.0/24	Floor 4 Cameras
192.168.105.0/24	Floor 5 Cameras
192.168.106.0/24	Floor 6 Cameras
192.168.107.0/24	Floor 7 Cameras
192.168.108.0/24	Floor 8 Cameras
192.168.109.0/24	Floor 9 Cameras
192.168.200.0/24	NVR Network
192.168.300.0/24	Management Network

---

Enterprise Data Flow

IP Cameras
     │
CAT6
     │
48-Port PoE Switch
     │
SFP Module
     │
Single-Mode Fiber
     │
Main ODF
     │
Cisco Catalyst C9300X-24Y
     │
24-Port Gigabit Switch
     │
5 Hikvision NVRs
     │
Video Wall

---

Troubleshooting Tips

Problem	Solution
Duplicate IP address	Assign unique static IPs and maintain an IP inventory.
Camera unreachable	Verify VLAN, gateway, switch port, and camera IP settings.
NVR cannot add cameras	Check routing, firewall rules (if any), and camera credentials.
Wrong subnet mask	Use a consistent subnet mask across each VLAN.
Intermittent connectivity	Inspect fiber uplinks, SFP modules, and switch logs.

---

Best Practices Checklist

✅ One VLAN per floor

✅ One IP subnet per VLAN

✅ Static IPs for all cameras and infrastructure

✅ Separate NVR and management networks

✅ Label cameras, switches, ODF ports, and fiber links

✅ Document all IP addresses and VLAN assignments

✅ Reserve spare IP addresses for future expansion

---

Conclusion

A structured IP addressing and VLAN design is essential for any enterprise CCTV deployment. By assigning each floor its own VLAN and subnet, separating NVR and management traffic, and using consistent naming and static IP addressing, you create a network that is easier to manage, more secure, and ready for future growth.

---

📘 Next Tutorial

Cisco Catalyst C9300X-24Y Security Hardening for Enterprise CCTV Networks

Topics will include:

• Initial security configuration
• SSH configuration (disable Telnet)
• AAA (Authentication, Authorization, and Accounting)
• Port Security
• DHCP Snooping
• Dynamic ARP Inspection (DAI)
• IP Source Guard
• Storm Control
• Access Control Lists (ACLs)
• BPDU Guard and Root Guard
• Secure SNMP configuration
• Syslog and NTP setup
• Configuration backup and recovery
• Security best practices for enterprise surveillance networks

This tutorial will help transform your Cisco core switch from a basic network device into a secure enterprise backbone for your Hikvision CCTV infrastructure. CCTVCameras Step by step Installation and Configuration By Ai Tech Pro Guide (aitechproguide.blogspot.com)