Omada VLAN design — hands-on separation of guest, CCTV, and business

If CCTV and the business network are on the same VLAN, the entire office is exposed when one camera is compromised. This outlines the procedure for creating minimal isolation in Omada SDN.

VLAN ID design

Many places use the management VLAN as the default VLAN 1, but it is better to separate it with a separate ID if possible.

Configuration order

1. Settings → Wired Networks → LAN → Create New LAN
2. Enter VLAN ID / Gateway / Subnet, specify DHCP range
3. Switch → Ports → assign a VLAN Profile to the target port
4. Deploy settings via Devices → Provision
5. Block inter-VLAN traffic with ACLs when necessary

ACL — what actually needs to be blocked

• Block all guest → business network traffic (default)
• CCTV → block internet access, allow communication only with the NVR
• Work → allow CCTV viewing only (NVR web port)
• The management VLAN is accessible only from designated management PCs

If CCTV is completely offline, remote monitoring is not possible. A practical configuration is to expose only the NVR externally and prevent the cameras themselves from accessing the internet.

commonly overlooked points

• When the AP's management IP moves to the guest VLAN and remote management is cut off
• When the NVR can't find the camera — mostly due to inter-VLAN routing not being allowed
• PoE budget exceeded — need to calculate number of cameras × power consumption