Cisco Video Surveillance Design Guide for the UCS Express Platform
Available Languages
Table Of Contents
Video Surveillance Design Guide for the UCS Express Platform
Integration with Ancillary Subsystems
Video Data-Mining and Analytics
Virtual Machine Considerations
Example 1—Network Bandwidth Usage
Example 2—Sites with Remote Storage
Example 3—Virtual Matrix Scenario
Example 4—Distributed Media Servers
Determine Bandwidth and Storage Estimates on each VSMS
Video Surveillance Design Guide for the UCS Express Platform
November 2012This design guide summarizes high-level design recommendations and best practices for implementing IP video surveillance on the Cisco® Unified Computing System™ (UCS) Express platform in Branch offices.
Contents
This document includes the following sections:
Introduction
This design guide summarizes high-level design recommendations and best practices for implementing IP video surveillance on the Cisco UCS Express platform in Branch offices. In some instances, existing network equipment and topologies have the necessary configuration and performance characteristics to support high-quality IP video surveillance. In other instances, network hardware might require upgrading or reconfiguration to support increased bandwidth needed to support video.
This guide also details design considerations of the Video Surveillance Manager (VSM) on the UCS Express on the Integrated Services Router Generation 2 (ISR G2).
Note
This design guide does not describe the configuration and operation of the Video Surveillance Manager (VSM) products; however, for more detailed information, see the "More Information" section.
Note
Figure 1 displays the Cisco ISR platform integrating video surveillance on a single network access device for remote sites.
Figure 1 Cisco Integrated Services Router Platform Integrates Video Surveillance on Single Network Access Device for Remote Sites
Solution Components
The required components for designing and deploying VSM on the UCS Express platform include:
•
•
•
•
Logical Network Topology
Figure 2 illustrates the overall logical topology of the networking and video surveillance components, including an UCS Express containing the SRE-V running VSM and VSOM, various IP cameras, an external switch, and the operator workstations running the VSOM client.
Figure 2 Logical Network Topology (External or Internal Switch in ISR
IP Network Infrastructure
Bandwidth
The bandwidth requirements for all video, but video surveillance in particular, is substantial compared to Voice over IP (VoIP). Common codecs used in VoIP deployments (G.711, G.729, G.726) use between 8 and 64 Kbps for voice encoding. A packet capture from a Cisco Video Surveillance 2600 Series IP camera configured at a constant bit rate (CBR) target of 1 M for the MPEG4 feed with audio-enabled on the camera. Control (Hypertext Transfer Protocol [HTTP]/Real-Time Streaming Protocol [RTSP]) is also captured. Figure 3 illustrates the relationship between the amount of audio, video, and control plane.
Figure 3 Audio and Video Network Load
The bandwidth requirement for the video media stream is of a magnitude higher than audio (VoIP) and signaling (RTSP) for video in the enterprise network.
While provisioning for this bandwidth requirement is a key element in planning for video in the enterprise network, there are other network requirements to be considered. For example, will the video traffic be segmented on both the local-area network (LAN) and WAN from other user traffic, either logically or physically? Is the video deployment an overlay on an existing network infrastructure or is it an entirely new deployment? Is IPsec encryption currently implemented? These factors must be considered, along with the bandwidth requirements.
QoS
Quality of Service (QoS) is a key element to managing network congestion during periods where bandwidth is constrained. QoS, however, does not eliminate bandwidth constraints; it manages the access to bandwidth by competing applications through prioritizing one application over another. QoS manages unfairness. Because the video quality for MPEG-4 and H.264 is highly dependent on little or no packet loss, IP video surveillance traffic must not be dropped by the enterprise QoS policy. Motion JPEG-based video does not suffer degradation in the image with packet loss due to lack of bandwidth, but the smoothness of motion is compromised. Several frames or even several seconds of video may be missing with no indication of loss. Because many video surveillance deployments are headless, the first time the video is viewed may be days or weeks after capture. If the quality is poor due to packet loss in the network, there is no recourse and the video data is worthless.
Security
Security focuses on controlling what users have access to a resource while in transit, at the originating node, or when it is processed or stored on a server. One aspect of IP networking is the any-to-any connectivity between networks and users. This strength is also a flaw. There is a certain population of users on the network that must have access to the video surveillance system, but many cannot be trusted to access this data. Because access to the system by unscrupulous individuals can expose the enterprise to financial loss and compromise personal safety, video surveillance data is particularly sensitive. This design guide illustrates how to transport video traffic over LAN and WAN with IP security encryption, and also implement administrative controls on who has access to the network.
Network Services
One advantage of the any-to-any aspect of IP networks is resource and system access. The Network Time Protocol (NTP) and Syslog messages are examples of network services that IP cameras can request data from and send data to, which are either not available with analog-based systems or are more costly to implement. Additionally, local utilities like Power-over-Ethernet (PoE) and the Cisco Discovery Protocol (CDP) both lower the cost of installation and facilitate troubleshooting.
Network Management
Network management applications and protocols are described (see "Network Services") where IP service-level agreements (IP SLAs), Syslog, CDP, and Simple Network Management Protocol (SNMP) are shown in relation to video surveillance deployments. Enterprise networks vary in degree of sophistication and maturity of network management. IP video surveillance, however, is one application that can greatly benefit from a proactive approach to the Fault, Configuration, Administration, Performance, and Security (FCAPS) model. For example, in headless deployments (video feeds that are not actively monitored by a person), the availability and network performance is critical to ensuring quality video recordings. The network management platforms and processes of the enterprise can help the physical security manager in detecting and reacting to an endpoint or network transport issues that could impact video quality.
Integration with Ancillary Subsystems
Physical security is one component of facilities management in many large organizations. Other components include door access control, which is often closely linked with video surveillance as a key component to the safety and security missions. To achieve the goal of a fully-converged network, the other Building Management Systems (BMSs), such as fire alarms, elevator control (to park elevators in the event of a fire), air quality monitoring (carbon monoxide and smoke detection), and lighting and heating/cooling must be able to communicate with the video surveillance systems.
The first step in achieving this goal is to IP-enable these devices and provide the network infrastructure to support their effective communication between systems. For example, if virtualization is enabled on the IP network to support video surveillance, a practical approach is to also include the BMS devices on the same address space, and in the same network segments, as the video surveillance devices. Typically, the bandwidth requirements of BMSs are trivial to that of video surveillance, the end users of the data often report to the same organization heads and the likelihood of system integration (now or in the future) is high.
Video Data-Mining and Analytics
The end goal of migrating from analog-based systems to IP-enabled video surveillance is to move the application from targeting loss prevention, compliance, safety, and security to obtain a greater business value by increasing sales and reducing expenses and exposure to liability. Data mining is the process of detecting some pattern in data. One video surveillance application can be to analyze video feeds to detect certain colors or articles of clothing to identify groups of gang members among patrons at a shopping mall. Video analytics use data mining techniques to detect patterns in data. Video analytics may be performed at the endpoint (IP camera) on specialized digital signal processors (DSPs) by a third-party analytics vendor, or by servers within the enterprise data center. One video analytics application is to detect the queue length of checkout lines and inform management to increase or decrease the staffing at cash registers to more fully use staff.
In the future, the analysis output of video data can be more economically valuable than the loss prevention role of video surveillance to many retail organizations.
Virtual Machine Considerations
Note
NTP Considerations
NTP must be configured on the VM and ESXi host. Time sync on VMware tools should be disabled on the VM. For more detailed instructions, see the Video Surveillance Deployment Guide for UCS Express (http://www.cisco.com/en/US/docs/security/physical_security/video_surveillance/network/vsm/ucse/deploy/VSM-SRE-deployment.pdf).
Performance and Scalability
The scalability numbers for the VSM VM are as follows:
•
•
•
Storage Requirements
Only onboard storage is currently supported. External iSCSI storage is not supported. Usable storage is based on the redundant array of independent disk (RAID) level used. For information about adding a media partition to the VSM VM, see the Video Surveillance Deployment Guide for UCS Express (http://www.cisco.com/en/US/docs/security/physical_security/video_surveillance/network/vsm/ucse/deploy/VSM-SRE-deployment.pdf).
Backup Servers
The Video Surveillance Media Server Backup Server (VSMS-Backup) allows you to configure a secondary server to use if a VSMS becomes unavailable. You can specify any VSMS as a backup server. For details about adding a backup server, see the "Adding a New Server" section in the Cisco Video Surveillance Manager User Guide, Release 6.3.2 (http://www.cisco.com/en/US/docs/security/physical_security/video_surveillance/network/vsm/6_3_2/user_guide/vsmug.pdf).
To back up video archives, the system must have at least one VSMS-Backup server. The VSMS-Backup server must have a repository for archive backups from other servers. For more information about creating archive backups, see the "Creating Archive Backups" section in the Cisco Video Surveillance Manager User Guide, Release 6.3.2 (http://www.cisco.com/en/US/docs/security/physical_security/video_surveillance/network/vsm/6_3_2/user_guide/vsmug.pdf).
Recovery Considerations
To support the recovery of VSM 6.3.2, allocate 65 GB of disk space, 32 GB for the actual VSM VM, and 32 GB for the recovery.
WAN Considerations
A wide-area network (WAN) is used to connect different local-area networks (LANs) and typically covers a broad geographic area. WAN services are leased from service providers who provide different speeds and connectivity options.
Figure 4 displays how a remote branch office relies on the connectivity provided by a WAN service provider.
Figure 4 Service Provider Network
Deploying a video surveillance solution through a WAN environment presents challenges that are not typically seen in a LAN. In a LAN environment, it is common to see 1 Gbps and 10 Gbps of bandwidth, while in a WAN environment, most connections are less than 10 Mbps; many remote connections operate on a single T1 (1.544 Mbps) or less.
These inherent bandwidth constraints require careful evaluation of the placement of cameras and Media Servers, and how many viewers can be supported at remote sites simultaneously. By using child proxies, bandwidth requirements can be reduced to transport video streams across WAN connections.
The placement of recording devices also becomes important. The video can be streamed to a central site using lower frame rates or resolution, but another attractive alternative is to deploy Media Servers at the remote sites and stream the traffic using the LAN connectivity within the remote site.
A point-to-point or leased line is a link from a primary site to a remote site using a connection through a carrier network. The link is considered private and is used exclusively by the customer. The circuit usually is priced based on the distance and bandwidth requirements of the connected sites.
Technologies, such as Multilink Point-to-Point Protocol (PPP), allow several links to be bundled to appear as a single link to upper routing protocols. In this configuration, several links can aggregate their bandwidth and be managed with only one network address. Because video surveillance traffic requirements tend to be larger than other IP voice and data applications, this feature is attractive for video surveillance applications.
Hub-and-spoke, also known as star topology, relies on a central site router that acts as the connection for other remote sites. Frame Relay uses a hub-and-spoke topology predominantly due to its cost benefits, but other technologies, such as Multiprotocol Label Switching (MPLS), have mostly displaced Frame Relay.
Example 1—Network Bandwidth Usage
Figure 5 illustrates a simple scenario with two sites. Each site has a Media Server and each is the direct proxy for an IP camera. Three Operations Manager (OM) viewers are active in Site A and each IP cameras generates 1 Mbps of network traffic.
Note
Two OM Viewers display video streams from Camera 1 and Camera 2, while one OM Viewer displays three video streams: two streams from Camera 1 and one stream from Camera 2. The network bandwidth required to display video streams for Camera 2 in Site A is relatively small for a LAN environment, but the traffic from Camera 1 can be significant for WAN environments because four different 1 Mbps streams must traverse the WAN locations.
Figure 5 Network Bandwidth Requirements
Example 2—Sites with Remote Storage
Figure 6 displays how Media Servers can be deployed at different WAN locations to minimize the bandwidth requirements. By deploying the Media Servers close to viewers and edge devices, the network traffic remains local to each site. Archiving video streams at each location is also an attractive solution to minimize the network traffic between sites.
Figure 6 Sites with Remote Storage
In this example, Site A and Site C have Media Servers acting as direct proxies and archives for the IP cameras. Because both sites archive and distribute video to the OM viewers locally, the network traffic remains local to each site.
Site B can function without a local Media Server, but all video streams must traverse the WAN connections. Because Media Server A is the direct proxy for Camera B, the 1 Mbps stream must reach Media Server A before reaching any OM viewers. A total of 3 Mbps would be required for both OM viewers in Site B to receive video from Camera B.
Example 3—Virtual Matrix Scenario
Figure 7 displays an example that includes a Virtual Matrix server and virtual machine (VM) monitors located at two different sites. The server on Site A acts as the Media Server, OM, and Virtual Matrix for the environment. To reduce bandwidth traffic, Media Servers are also installed on Site C and Site D.
A single OM and a single Virtual Matrix are adequate to support this scenario. Because the cameras are located on Site C and Site D, they are able to serve the local OM viewers at those sites. The Media Server on Site A can also be configured with child feeds that come from the remote media servers and provide those feeds locally to viewers and monitors on Site A.
Figure 7 Virtual Matrix Scenario
Example 4—Distributed Media Servers
Figure 8 displays a deployment with several remote sites, each with a local Media Server acting as the direct proxy and archive for local IP cameras. In this scenario, all recording occurs at the remote sites and live video streams are viewed by OM viewers and VM monitors (video walls) at the headquarters.
The Media Server at the headquarters could also have Parent-Child proxies to each remote Media Server and request the remote streams only when required at the headquarters. This would have less bandwidth impact when the same stream is requested by more than one viewer because the traffic would be contained locally in the headquarters LAN.
Figure 8 Distributed Media Servers
Design Checklist
The following design checklist facilitates pre-implementation planning and the decision process:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Pre-Configuration Work
•
•
•
•
–
–
–
•
•
Note
•
•
–
–
–
•
–
–
–
–
–
–
–
Determine Bandwidth and Storage Estimates on each VSMS
•
•
•
•
–
Note
–
–
Network Links
•
•
•
•
Network Reachability
•
•
•
More Information
For more information about Cisco-related products, see the following resources:
•
http://www.cisco.com/go/physec/•
http://www.cisco.com/en/US/products/ps11273/prod_installation_guides_list.html•
•
•
http://www.cisco.com/en/US/prod/collateral/ps10265/ps11273/installation_guide_c07-640002.html•
http://www.cisco.com/en/US/prod/collateral/modules/ps10598/white_paper_c11-611291.html
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)