Best Practice - LAN Only Firewall Config. CCTV Network

frank451

Hi

Ive been using PFSense/Netgate for many years but by no means a proffesional. We now have a large project to deploy for a CCTV system.

Could anyone provide a few pointers for best practices with the following setup.

CCTV Recording Servers - These need to be behind the firewall with access only to the end devices (cameras, radars, IO modules etc)
If i put these on default physical LAN1 would i then put end devices on a seperate LAN, or use VLANs etc?

2.We have some device that are on VLAN919 that come in from remote areas of a council network.
Do i set these up on a seperate physical LAN and add rules for routing between LAN1 & this LAN?

Infrastructure that is in place on the network switching will give me the ability to seperate VLANS and trunk ports etc.
Is this the best route to take give queries above?

Any advice would be greatly appreciated.

Thanks