Interesting network design problem (advanced sub-netting issues)

Question

2 clients share a town house together; Each has "X" number of floors. One has the top few the other the bottom. The issue is there are a number of IP security cameras, some private to each network and about 6 that they must share (front door, back door, etc).

So here is what I am thinking for a network design. (I'm open to any ideas you might have and please feel free to criticize the network design in it's entirety. I never take this stuff personally.)

Potential Networks: 3 separate switches backboned each with their own IP range. 10.1.10.x -- top floors -- gets own Internet router 10.1.11.x -- shared IP security cameras 10.1.12.x -- bottom floors -- gets own Internet router

Issues: 2 separate networks that need to share IP video cameras each will have there own Internet access and IP router

Question: How to best allow them to share the middle IP range but not cross over to the other network?

Answer: Subnet networks with 255.255.254.0 potentially allowing each network to have access to the 10.1.11.x address.

Potential problem: 10.1.12.x network might have issues with broadcast; it will be looking for that to be in 10.1.13.255 which we will not be using...

---

Other network design idea (which is also a Question): can two 10.1.10.x networks that are 'side by side' share a 10.1.11.x network but not each others packets?

   VLAN? 

Problem: no shared network closet...

---

Answer 1

The general solution of 3 subnets is workable, but you will not be able to use a netmask of 255.255.254 to overlap the middle camera subnet with the other two. That particular mask will create two mutually exclusive subnets of 10.1.1.10/23 and 10.1.1.12/23. If you instead place a router between each pair of switches, you can have them route traffic between the networks appropriately. This has the added bonus of the ability to apply ACLs on each router to keep traffic from the two networks isolated as necessary.

For example:

10.1.1.10/24 --- router1 --- 10.1.1.11/24 --- router2 --- 10.1.1.12/24
                    |                            |
                  ISP1                          ISP2

This requires each router to have 3 ports, one to the internet, one to the private subnet, and one to the shared subnet. Then each private subnet can use the router as the default gateway to reach either the internet or the shared camera subnet. The cameras will either need two routes, or have router1 and router2 redirect traffic to the other network as appropriate while each camera points to one or the other as their default gateway.

Alternatively, I imagine VLANs could be used to obtain a desirable result, using a wider netmask that contains all three networks. Each private network would have a VLAN with the cameras being members of each. This should enable the desired results, although I am not a VLAN expert, so I may be missing something for this solution.

Answer 2

Here is another option.

Deploy a switch supporting private VLANs in each client space. Uplink the switches together. Configure the uplink ports as a trunk and enable dynamic VLAN distribution and creation for these ports using VTP or GVRP depending on the switch vendor.

Create a private primary VLAN, 2 community VLANs, and a promiscuous VLAN. Assign the community and promisuous VLAN to the private primary VLAN. Put all ports, except the shared camera ports, for customer A in one community VLAN and do the same for customer B using the other community VLAN. Place the shared camera ports on each switch in the promiscuous VLAN.

Assign Internet router A with a static IP of 10.1.10.1/23 network and Internet router B with a static IP of 10.1.11.1/23. Configure DHCP on Internet router A to hand out ip addresses from the 10.1.10.2 - 255/23 range with a default gateway of 10.1.10.1. Configure DHCP on Internet router B to hand out ip addresses in the range 10.1.11.2 - 254/23 with a default gateway of 10.1.11.1. Under this setup the shared cameras could end up with an assignment from either DHCP server. If you need static ip addresses for the cameras just use ip addresses from the 10.1.10.0/23 network and exclude these from the DHCP assignments above.

With this configuration each customer will be able to send traffic to the devices in their network including their Internet router, the shared ip cameras, but not each other. No firewalls or router access list needed.