[EvanAnderson]

To echo: In small installs I don’t give the cameras a default gateway and put a NIC (physical or virtual) in-subnet with the cameras. Nothing else goes in the subnet.

In larger installs it’s a VRF dedicated to the camera subnets and a similar dedicated NIC arrangement on the server.

Nothing should talk to the cameras except the recording server they’re streaming to.

[angry_octet]

And you should consider that the ethernet endpoint of each camera may be accessible, perhaps with only limited physical breakage, and provide an entry point onto the network. Having each device on its own /30 is one way to do that, with routing restricted to talking to the server, or you might have a private VLAN feature on your switch. You can have multicast from the cameras go to other devices though.

Annoyingly, few TVs have multicast receivers, it's all Chromecast etc, so you need your own computers to decode and display.