OOB, Control VLAN or firewall: which connection fits your AV network?

Series: Connecting AV and IT networks without losing control

Controlled connection instead of opening everything

In the previous blog, we looked at the question: what actually needs to communicate between AV and IT?

Once that is clear, you can choose how to make that communication possible. In practice, three models are used often:

1. Out-of-Band management
2. AV Control VLAN or Management VLAN
3. Routing through firewall policies or ACLs

Each model has its own use case. The right choice depends on scale, security requirements, management agreements and the type of AV traffic.

Method 1: Out-of-Band management

Out-of-Band management, often abbreviated as OOB, means that you use a separate management network that is independent from the production or media network.

This can be done through dedicated management ports, separate management switches or a dedicated management VLAN.

The advantage is clear: if something goes wrong in the AV media network, you can often still manage the infrastructure through the OOB path. This is valuable in critical environments such as broadcast, theaters, stadiums, control rooms, universities and large corporate installations.

A simplified design:

IT / management station
  |
OOB management network
  |
Switch management / routers / controllers

AV media remains separate

The downside is that OOB requires extra design work. You need additional ports, IP planning, cabling and management agreements. Not every AV device has a separate management port.

OOB is therefore especially strong for infrastructure management: switches, routers, controllers, servers and critical management systems.

Method 2: AV Control VLAN or Management VLAN

A Control VLAN is a separate VLAN for operation, configuration and light integration. It is not the same as the Dante, NDI or video VLAN.

For example:

IT network
  |
Firewall / ACL
  |
AV Control VLAN
  |
Touch panels, controllers, management tools

AV Media VLANs
  - Dante
  - NDI
  - Q-SYS
  - Video

This model is often practical in corporate AV. You keep audio and video streams local, while making control and management available to the right systems.

Examples:

AV admin laptop -> Q-SYS Core
IT monitoring -> NETGEAR switches
Touch panel -> room control
Dante Controller -> Dante devices
NETGEAR Engage -> AV switches

Important: a Control VLAN does not mean you should simply stretch that VLAN across the entire corporate network. In many cases it is better to keep the VLAN inside the AV zone and give specific IT subnets access through firewall rules.

In other words: share access, not necessarily Layer 2.

Method 3: Routing through firewall policies or ACLs

In larger organizations, routing through a firewall or Layer 3 switch is often the best approach. You route between IT and AV subnets, but only allow what is needed.

NETGEAR documents scenarios where VLANs on a managed switch receive routing, and routes on the firewall are pointed back to the core switch so VLANs can receive internet access or controlled reachability.

An enterprise-style model:

IT client VLAN
IT management VLAN
Server VLAN
  |
Firewall / Layer 3 policy
  |
AV management VLAN
AV control VLAN
AV media VLAN

The firewall then decides what is allowed.

For example:

IT management -> AV management: allowed
Monitoring -> AV switches: allowed
AV devices -> NTP/DNS: allowed
Guest Wi-Fi -> AV: blocked
General IT clients -> AV media: blocked

MITRE recommends this principle more broadly in security: use ACLs for deny-by-default behavior and firewalls to restrict traffic between network segments.

Which method should you choose?

For small standalone installations, a fully separate AV network may be enough, possibly with a temporary management connection.

For meeting rooms and corporate AV, a Control VLAN with firewall rules is often the best balance.

For larger enterprise environments, Layer 3 routing through firewall policy is usually the most manageable approach.

For critical infrastructure, OOB management is strongly recommended.

A practical decision guide:

Small installation:
- separate AV network
- optional limited management connection

Corporate AV:
- AV control VLAN
- management limited through firewall

Enterprise:
- routed AV zones
- firewall policies
- monitoring and logging

Broadcast / mission critical:
- dedicated AV fabric
- OOB management
- strict change control

What to avoid

Avoid the scenario where the AV network is opened completely to IT “for convenience”.

Also avoid stretching VLANs throughout the building without a clear reason. It makes troubleshooting harder and increases the chance that multicast or discovery reaches places where you do not want it.

Conclusion

There is not one correct way to connect AV and IT. OOB, Control VLANs and firewall routing each have their place.

The common thread is always the same:

Connect only what is needed, limit who can access it, and keep AV media as local as possible.

In the next blog, we look at a method that is often used in practice, but also often misunderstood: NAT.