Split a subnet in a server room (VLAN? HNV Gateway)?

Question

Mikrotik

For work, I got a network 192.168.0.0/22, about 12 Hyper-V servers (50 virtual), about 40 IP phones, 20 IP cameras, 150 computers. All this is in the same network, not divided into VLANs in any way. We have several Zyxel 2200-48 - 4 pcs. Also Mikrotik. About 5-8 hubs for 16 ports. DHCP and DNS MS Windows.
I can re-switch the server room, but I definitely can’t pull the wires throughout the production. Wires for cameras and telephones with computers are not marked. Separate servers from the entire local network (perhaps even separate Hyper-V from Virtual Machine, Hyper-V Gateway?)
I would also like to separate IP traffic from computers, and of course cameras into a separate VLAN. OSPF is not supported by Zyxel.
I would like to do something tagging so that the frame is tagged depending on the subnet on the first possible managed switch. There is also a block of other people's MAC addresses, there are enough figures with their devices.
Karoch Chaos and only, it is necessary to put in order. Tell me how you can do without a global line constriction, but at least make the "head" part normal.

Answer 1

As advised above, you begin to draw up a physical network diagram, for this you look at the table of mac addresses on the switches, match mac addresses with ip, for this you scan the network with something like an advanced ip scanner. For completeness and beauty, you sign the ports. After drawing up the physical scheme, you begin to plan the logical one, come up with network addressing for different vlans, the vlans themselves. Routing m / y by waves, in principle, can be assigned to Mikrotik, since Zuhel does not know how to do it. To protect against intruders, enable and configure dhcp-snooping, port-security, ip source guard and turn off unused ports.