Most conversations about IP video surveillance start with cameras — resolution, lens selection, where to mount them. Those decisions matter, but they aren’t what determines whether a system still performs well after installation.
The infrastructure behind the cameras decides that: how footage is stored, how much bandwidth and power the system needs, how the camera network is segmented, what happens during an outage, and how remote access is secured. This is the part of a deployment nobody discusses until a drive fails, a switch runs short on power, or a camera system turns up on an internet scan.
Storage and Retention Planning Comes First, Not Last
Storage is usually the last thing decided on a surveillance project and the first thing that causes problems. Start with a retention requirement — how many days of footage need to be recoverable — and size the system backward from there, instead of buying a recorder with a fixed drive capacity and hoping it’s enough.
Retention needs vary by industry: a distribution center tracking cargo may need 60 to 90 days, a school district follows a period set by district policy, and a retailer doing loss prevention work often wants footage held through a full chargeback cycle. Settle that number before storage gets sized, not after. From there, total storage is a few variables multiplied together — camera count, resolution, frame rate, compression, and retention days:
- Resolution and frame rate drive storage more than expected — a 4K camera can need several times the storage of a 1080p camera on the same scene
- H.265 compression typically cuts bitrate and storage by roughly 40 to 50 percent versus H.264 at comparable quality
- Scene activity affects file size too, since a busy loading dock generates more data than a quiet hallway under variable bitrate encoding
- Camera count and retention window are the direct multipliers — doubling either one roughly doubles total capacity required
Where storage lives is a separate decision from how much is needed. A local NVR keeps footage on-site with no recurring bandwidth cost, but becomes a single point of failure — stolen, burned, or failed, and the footage goes with it. Cloud or hybrid storage adds an off-site copy but depends on upstream bandwidth and an ongoing subscription cost. Most sites we work on land on a hybrid model: local NVR storage in RAID — RAID 5 or 6, not a stack of independent drives — for day-to-day recording, with critical cameras or flagged events backed up off-site. RAID matters because a drive failure on a recorder running continuously is a matter of when, not if.
Bandwidth and PoE Power Budgeting
Camera counts creep upward as alternates and future phases get added, so power and network infrastructure need to be sized for where the system is headed, not just where it starts. PoE, PoE+, and PoE++ (802.3af/at/bt) each supply different maximum wattage per port, and camera draw varies more than assumed: a basic fixed-lens camera might pull under 6 watts, while a PTZ camera or an outdoor unit with IR illuminators and a heater can pull 25 to 60 watts.
The mistake we see most often is a switch with plenty of open ports but not enough total power budget to run them all at once — a 24-port PoE+ switch doesn’t have 24 ports’ worth of power available simultaneously, it has a shared budget divided across whatever’s drawing current. Bandwidth planning works the same way: plan for the aggregate, not the average. Multiply each camera’s bitrate by camera count, add headroom for remote viewing and export, and confirm the total fits the switch backplane and, especially, the uplink back to the core — that’s where oversubscription shows up first.
Keep Camera Traffic on Its Own VLAN
IP cameras are, from a security standpoint, one of the least trustworthy device categories on a network. They run embedded firmware that doesn’t get patched as consistently as a server, some still carry default credentials, and they’re physically reachable in ways a rack-mounted server isn’t — a camera outside a loading dock is accessible to anyone standing under it. Cameras on the same flat network as workstations and point-of-sale systems mean a compromised camera becomes a direct foothold into everything else.
The fix is one of the most consistently skipped steps we find auditing existing systems: put camera traffic on its own VLAN, separated from data and voice, with firewall rules restricting what that VLAN can reach — typically just the NVR and an NTP time source, nothing else. Port security or 802.1x on those switch ports adds another layer, so unplugging a camera and plugging in a laptop doesn’t hand someone a path into the rest of the network.
Build Redundancy Into the Parts That Can’t Go Down
Not every camera needs a redundant path, but infrastructure supporting safety monitoring or incident investigation should be built assuming components will eventually fail. On critical deployments, that means covering:
- UPS battery backup on switches, the NVR, and head-end gear, tested periodically, since a dead battery doesn’t announce itself until the power goes out
- Redundant uplinks between switches and the core, so one failed cable or port doesn’t take a building’s camera feed offline
- RAID at the NVR level, so a single drive failure doesn’t cost days or weeks of footage
- Onboard SD card recording at the camera, so a temporary loss of NVR connectivity doesn’t mean that footage is simply gone
The exercise worth running on any critical deployment is tracing the full chain from camera lens to viewable footage and asking what happens at each link if it fails. Most gaps show up in that walkthrough, not on a spec sheet.
Remote Access Belongs Behind a VPN, Not on the Open Internet
One of the most common issues we find auditing existing systems is an NVR’s web interface, or individual cameras, port-forwarded directly to the public internet so someone can check footage from a phone. It’s an understandable shortcut and also one of the more dangerous things a network can do — internet-facing recorders get discovered by scanning tools within days, targeted with credential-stuffing against default logins, and remain a documented entry point for ransomware and botnet activity.
Remote access should go through a VPN instead — site-to-site for a remote location, client VPN for individual users — so the camera VLAN is never directly reachable from the open internet. A VMS platform’s own cloud relay is a reasonable alternative as long as it doesn’t require opening inbound firewall ports. Either way, remote administrative access should require multi-factor authentication, and default credentials on every camera and recorder should be changed at commissioning, not left for later.
Firmware and Patch Management Isn’t Optional
Cameras, NVRs, and switches all run firmware, and firmware has vulnerabilities discovered on an ongoing basis like any networked device. Because cameras are mounted out of sight and, once working, tend to get ignored, they’re often the least-patched devices on a network — nobody notices outdated camera firmware the way they’d notice a laptop nagging about an update.
A workable process doesn’t need to be complicated, but it needs to exist: keep an inventory of installed firmware versions, monitor vendor security advisories, test updates on a sample device before pushing them fleet-wide, and disable unused services like UPnP or unencrypted web access. This is ongoing maintenance, not a one-time task, and it’s the piece most likely to get skipped once a system is running smoothly.
None of this is visible to someone walking past a camera in a hallway, which is exactly why it gets overlooked. A system can look complete with cameras mounted and a live view on a monitor while still being one drive failure, one power blip, or one exposed port away from losing the footage that matters. The infrastructure decisions made before commissioning are what determine whether that live view is backed by something reliable.
We approach IP video surveillance as a network engineering project first and a camera installation second, because that’s what actually determines whether the system holds up. Our team’s networking and security certifications from Cisco and Fortinet, alongside video platform training from Hikvision, mean storage sizing, PoE budgeting, VLAN segmentation, and remote access design get planned alongside the camera layout instead of bolted on afterward — the same standard we apply for clients across Chicago and the greater Midwest.