Just a few pointers: The MX will, in common with layer-3 switches, permit traffic between VLANs, unless you specifically deny it. The MX's general deny relates to inbound sessions from the Internet (WAN). You do indeed need to be clear about where you want to route between your VLANs. If you want to control inter-VLAN traffic via the GUI on the MX (which it sounds like you want, for enhanced security), then the Default Gateway, for each client in each VLAN, needs to use the MX's IP in that VLAN: x.x.x.1 (i.e. that's the gateway IP in your DHCP scope - and all your statically configured devices will need configuring to match, too) What it looks like you've done is also configure VLAN interfaces, for each VLAN, on your switch stack. While the VLANs need to exist on the switch stack, I suspect not all the VLAN interfaces are needed (you may need one, to allow you to manage the switch stack - you'll need to consult Extreme documentation, to check on that). A VLAN interface is, for most switching OSes, only needed when you want to route in & out of that VLAN on the switch in question. If you want to route solely on your MX, it's only important that all your VLANs are 802.1Q trunked between the MX and the switch stack (appropriately configured at both ends). I'm wondering if your camera system relies on the cameras and server being in the same VLAN, for discovery purposes; possibly because the cameras use broadcast or multicast frames to search for a local server? (such frames don't flow between VLANs). You'll need to look into the camera system documentation - or maybe run a packet capture on the LAN side of your MX, to see what the cameras are doing?
... View more
