Product · Network infrastructure
The network your security stack actually runs on.
Managed switches, Wi-Fi 6 and 7, fiber backhaul, point-to-point wireless, and VLAN segmentation. Sized for the security fabric, not a generic IT network. One vendor for cabling, network, and cameras keeps the install accountable.
- NDAA-compliant
- Platform-agnostic
- 1,000+ deployments over 15 years
How can we help?
Tell us what you're working through. We'll route it to the right person.
Tec-Tel designs, installs, and maintains the network layer behind security cameras and access control: managed switches, Wi-Fi access points, fiber backhaul, point-to-point wireless, and VLAN segmentation. We deploy Cisco Meraki, Ubiquiti UniFi, Cisco Catalyst, and Aruba where the use case fits. One vendor for cabling, network, and cameras keeps the install accountable. Free consultation on your topology.
§01 What the network scope covers
What is actually in the scope.
The network behind a modern security install is a sized, segmented, hardened fabric that carries continuous video traffic, time-critical access events, and Wi-Fi for staff and guests. A typical Tec-Tel network scope covers six pieces.
§02 Vendor breadth
Four platforms that cover the most common commercial use cases.
Cisco Meraki: cloud-native, no on-prem option. NDAA Section 889 self-certified. Headquartered in United States (San Francisco, CA). Best for cloud-managed simplicity at premium pricing, easy multi-site rollout.
Ubiquiti UniFi: cloud-native plus on-prem option. NDAA Section 889 self-certified. Headquartered in United States (New York, NY). Same cloud-managed shape as Meraki at half the price, with on-prem-or-cloud flexibility.
Cisco Catalyst: on-prem. NDAA Section 889 self-certified. Headquartered in United States (San Jose, CA). For federal-touching deployments and multi-thousand-port enterprise networks where IOS XE and CLI control are non-negotiable.
We also install HPE Aruba in customer environments where Aruba ClearPass for RADIUS is already deployed, and Extreme Networks for K-12 and higher-ed customers. Customers running Fortinet FortiSwitch with FortiGate firewalls keep that stack; we add the security VLAN and camera workload on top.
§03 One install, not three vendors
How cabling, network, and cameras fit together.
A typical commercial security install brings three trades: the cabling crew, the network engineer, and the camera installer. Split across three companies, that means three schedules, three change-order paths, and three parties pointing fingers when something breaks.
Tec-Tel runs all three under one accountable project manager. One estimator scopes the cable plant, the switch sizing, and the camera count off the same drawings. One project manager runs the install schedule across all three. One as-built record documents the cable runs, the VLAN map, and the camera positions in a single ZIP. When a port flaps in year three, there is one number to call and one team that knows the building.
§04 VLAN segmentation
A flat network is a security incident waiting to happen.
The 2017 Mirai botnet recruited tens of thousands of IP cameras into a DDoS army by exploiting the fact that they sat on the same subnet as workstations. The fix is VLAN segmentation: cameras get their own broadcast domain, with firewall rules controlling what gets in and out.
Default Tec-Tel commercial VLAN layout: VLAN 10 (Corporate) - workstations, file servers, printers, internet via main firewall. VLAN 20 (Voice) - IP phones, paging, intercom, QoS prioritized. VLAN 30 (Cameras) - IP cameras and recorders, no internet egress except VMS cloud over firewall rule. VLAN 40 (Access control) - door controllers, readers, intercoms, locked egress to vendor cloud only. VLAN 50 (Guest Wi-Fi) - captive portal, internet only, isolated from corporate. VLAN 60 (IoT and OT) - HVAC, BMS, sensors, egress firewalled per device class.
- → Camera VLAN blocks east-west traffic to corporate file servers.
- → Access control VLAN limits egress to vendor cloud endpoints only.
- → IoT VLAN prevents compromised sensors from reaching the corporate switching path.
- → Most modern compliance regimes (PCI, HIPAA, CMMC) effectively require this segmentation.
§05 Bandwidth planning
Camera traffic is heavier than most IT teams expect.
Roughly 1 to 8 Mbps per camera in continuous record mode at 1080p, depending on codec (H.265 cuts the bandwidth roughly in half versus H.264) and motion content. 4K cameras run 4 to 16 Mbps.
A 100-camera site can land anywhere from 100 Mbps to over 1 Gbps of constant internal traffic, which is why the camera VLAN needs its own gigabit uplink, not a corporate trunk. We size the switch uplinks and core capacity to the camera count and codec, not a guess.
§06 Cost bands
Network projects are sized on port count, not square footage.
Network projects scale on port count and building count, not square footage. What drives the total across common configurations:
- → Small office (single closet): switch, two or three Wi-Fi APs, basic firewall, VLAN config, and labor.
- → Mid commercial (multi-closet): adds redundant uplinks, multi-AP Wi-Fi heatmap design, fiber riser between IDFs, and a dedicated camera VLAN on a PoE+ switch.
- → Enterprise (multi-building): adds Layer 3 core switching, BGP or OSPF routing, controller-based Wi-Fi, and full RADIUS auth. Cost scales with port count and building count.
- → Inter-building point-to-point wireless: priced per link, driven by radio class and tower height.
Questions buyers ask us
FAQ
- Cisco Meraki, Ubiquiti UniFi, or Cisco Catalyst: which one fits us?
- Meraki for cloud-managed simplicity at premium pricing, no on-prem controller, easy multi-site rollout. UniFi for the same cloud-managed shape at half the price with on-prem-or-cloud flexibility, but a smaller support footprint. Catalyst for stuck-at-on-prem environments, federal-touching deployments, and multi-thousand-port enterprise networks where IOS XE and CLI control are non-negotiable. We pick by use case, not by SPIFF.
- Why does the security camera fleet need its own VLAN?
- Two reasons. One: a compromised IP camera (and there have been many) should not have a path to the corporate file server. VLAN segmentation plus firewall rules between VLANs stop east-west traffic. Two: cameras generate constant background traffic, and isolating them keeps that load off the corporate switching path. Most modern compliance regimes (PCI, HIPAA, CMMC) effectively require it.
- How much network bandwidth does an IP camera actually use?
- Roughly 1 to 8 Mbps per camera in continuous record mode at 1080p, depending on codec (H.265 cuts the bandwidth roughly in half versus H.264) and motion content. 4K cameras run 4 to 16 Mbps. A 100-camera site can land anywhere from 100 Mbps to over 1 Gbps of constant internal traffic, which is why the camera VLAN needs its own gigabit uplink, not a corporate trunk.
- Can you run cameras and access control on existing customer-owned switches?
- Sometimes. We test the existing PoE budget, the firmware version, the VLAN capability, and the management posture. If the switches are managed (Layer 2+ or 3) and have PoE headroom, we can ride them. If they are 10-year-old unmanaged switches with mixed PoE, we recommend a forklift on the security VLAN before deploying cameras. The consultation answers this.
- What drives the cost per network drop for a typical office build-out?
- The all-in cost per active port covers the cable, the jack, the switch port allocation, the labor, the PoE budget, and the VLAN configuration. Wi-Fi access points are a separate line, driven by the platform and the mounting environment. Switches scale on port count and PoE class. The free consultation prices the port count and AP coverage your site needs.
- Do you handle the VoIP and phone side too?
- We design and install the network layer that VoIP runs on (QoS, voice VLAN, switch power for IP phones, SIP trunk handoff), and we partner with VoIP platforms like RingCentral, 8x8, and Microsoft Teams Phone for the PBX layer. We do not sell our own PBX. Customers who need a single point of accountability on the network and the phone system tend to land here.
- How do cabling, network, and cameras fit together as one project?
- They are three trades on the same building, in the same week, with the same scope. We run all three under one accountable project manager. That means one estimator, one project manager, one as-built record, one set of test reports. When something fails six months later, there is one number to call. Coordinating three different vendors across a single install is where most security projects go sideways in year two.
- What is the right place for point-to-point wireless versus fiber?
- Fiber wins on reliability, latency, and weather. P2P wireless wins on speed-of-deployment and on cost when the run is cross-property, over a road, or temporary. We use 60 GHz unlicensed P2P for sub-kilometer hops between buildings on the same campus. We push for fiber on any permanent link over 1 km or any link where weather (heavy rain, snow load) can break the radio path.
See it live
Get a clear read on your network topology.
The free consultation covers your existing switches, AP coverage, VLAN map, and whether the network can carry the camera and access load you are planning.
- Tell us how many sites you run and what's already in place. We'll show you what a build or upgrade looks like.
- Straight answers from the team that does the work. We're platform-agnostic, so you get the system that fits your sites, not one brand's catalog.
Since 2010 · 1,000+ deployments nationwide · ISN-accredited
How can we help?
What you're looking for, plus any details. We review it and follow up, usually the same day.
Related from Tec-Tel
Structured cabling
The copper and fiber plant the network runs on. Cat6a, fiber backbone, closet design.
Read on ReferenceVendor comparison matrix
Full capability table across network platforms and NDAA Section 889 status.
Read on ProductSecurity cameras
The endpoint load the network has to carry. Camera bandwidth, PoE class, and VLAN design.
Read on