[walterbell]

http://rikfarrow.com/Network/net0103.html

> Switches were not designed as security devices. Their use as such simply evolved over time, and is ancillary to their main use as devices that improve network performance. If you use a switch for security reasons, you are relying on the correct configuration of the switch, including understanding not only the standards that the switch software is based upon, but also the correct implementation of those standards. The 802.1Q spec itself is 211 pages long, and is only one of a handful of standards that a compliant switch manufacturer must support. Any time that you need to segregate networks for serious security purposes, I recommend that you not use a switch.

"Framework for Layer 2 attacks" (2005), https://www.blackhat.com/presentations/bh-europe-05/BH_EU_05...

[sirmoveon]

You are not restricted to VLANs for isolation purposes. You can consider the entire PoE switch LAN as compromised. Then firewall the NVR, which would connect to that switch to pull the cameras streams. Any software in the cameras don't need to see WAN at all.