Network design for two organizations in one building with some shared devices

Question

A church & school that share a building have until now "co-existed" from a networking perspective... one ISP, one firewall/UTM, but generally have had separate L2 switches & end-user devices. We need to separate. A second ISP connection and a second firewall have been deployed. I'm now trying to restore the ability to share certain things... in this case, our IP-based video security system.

The security system consists of... 2 stacked Cisco POE switches (one in main bldg, one in gym - connected by fiber - running in L2 mode), 32 IP cameras connected to and powered by the switches, and a QNAP NAS-based NVR with 4 network adaptors.

If users/devices on both networks need to access the NVR for monitoring security, what is the optimal setup? So far I have kept the security switch in L2 and connected to the church's firewall (set as default gateway), but then have a connection from the school's firewall to one of the network adaptors on the NVR.

Ideally I would like to use the switch in the gym (that is part of the security system) for more than just security cameras... especially for extending the church and school wifi coverage. Based on what I've been reading it seems I may need to change the security switches to L3 and do some port configuration to make this happen.

Would really appreciate some advice on this.

Answer 1

Sorry, my response was too long for the comments section. I would take one of the routers and tie both internet connections to the WAN ports. Make the Church its own separate network and connect it to one of the LAN ports, do the same with the school network. You can then Setup "rules" in the router that connects each network to their own internet source. Give the Church and the School networks different IP Numbers(blocks).

You can then control the interactions between the two internal networks, what is allowed (files shares, etc...) and what is not allowed by setting up additional rules in the router. You can pretty much define anything you want to allow between the two networks and what you want to deny between them.

For the security system, I would also make it a separate network, and number it different from the other two. Put it on a third LAN port and grant the church and school networks access to it as needed. I would specify in the rules that the church and school networks can both access the security network devices (as needed) but cannot interact with each other on that (security) network.

Another choice to think about would be to connect the church network and the school network to the WAN ports of the second router, and the Security network to one of the LAN ports of the second router. You can then define the rules for the two networks to access the security network on this second router. It might simplify the rules you have to establish.

I hope this makes sense, maybe I'll draw you up a graphic...

Anyway, I hope that helps. You have all the equipment you need, but you will need to get to know the routers and how to define the rules for them. Note that some manufacturers use different terms, Zyxel may not call them "rules", they might call them something else, but its the same idea.

Good luck to you, I'd like to hear how it all shakes out in the end.

EDIT: Looks like the Zywall uses the term "policies" for what I refer to as "rules"