Power over Ethernet (PoE)

Mental model

A Cat5e/6 cable has 4 twisted pairs (8 wires). Standard 10/100 Ethernet only uses 2 of those pairs for data. Gigabit uses all 4 but only at a fraction of their voltage capacity.

PoE uses the same cable to carry 48 V DC to the connected device on top of the data. The receiving device (an IP phone, AP, camera) extracts the power and runs from it.

Why this matters in practice:

• One cable, no power adapter — IP phones, APs, badge readers, cameras all install without an electrician.
• One power budget at the switch — back up the wiring closet with one UPS, all PoE devices stay up during a power outage.
• Centralized control — switch can power-cycle a stuck AP or phone from a CLI.

If you’ve never wondered how the AP in your office ceiling gets power, the answer is: PoE from the switch.

The IEEE standards

Each standard supersedes but is backwards compatible with the older ones. An 802.3bt switch can power an 802.3af phone without issue.

There are also proprietary pre-standards — Cisco UPOE (60W), Cisco UPOE+ (90W). Same delivered power as 802.3bt but pre-dated the standard. Modern switches use the standard.

Watts to know:

• A typical Wi-Fi 6 AP needs ~25 W → PoE+ minimum.
• A high-end Wi-Fi 6E AP with multi-gig uplink can need 30–60 W → 802.3bt.
• A standard IP phone needs ~6 W → plain PoE is fine.
• A pan/tilt camera with IR + heater needs ~25–60 W → PoE+ or bt.

Roles — PSE and PD

A PoE injector is a small box that adds PoE to a non-PoE switch’s port — useful for one-off retrofits. A PoE splitter does the reverse on the PD side (delivers power and data separately to a device that doesn’t natively support PoE).

The negotiation — why you can plug your laptop into a PoE port safely

A PSE doesn’t just blast 48 V down the cable. It runs a detection and classification sequence first:

1. Detection — PSE applies a small voltage (2.7–10 V) and measures resistance. A real PD has a specific 25 kΩ signature resistor across the right pins. A laptop or random Ethernet device doesn’t → PSE sees no signature → never delivers power.

2. Classification — PD signals its class (0–8) by drawing a specific current under low voltage. Class maps to power range. PSE allocates from its budget accordingly.

3. Power delivery — once class is known and budget exists, PSE engages 48 V on the chosen pairs.

4. Continuous monitoring — PSE keeps detecting the PD’s “MPS” (Maintain Power Signature). If the PD goes away (cable unplugged), PSE shuts power within 300–400 ms.

5. LLDP-based negotiation (Cisco UPOE / 802.3bt). After the basic class, PD and PSE can negotiate a more precise wattage over LLDP — useful for class-4+ devices that want more than 30 W but only sometimes.

Power budgets — the gotcha that kills branch offices

A switch has a finite total PoE budget. Common values:

If you have a 24-port switch with 445 W budget and 24 Wi-Fi 6 APs at 25.5 W each → 612 W demanded → switch refuses to power all of them. Some ports stay dark.

Standard practice: when sizing a switch, calculate (number of PDs × max watt per PD) × 1.2 safety margin and pick a switch with that total budget.

Configuration — Cisco IOS

PoE is usually on by default on every PoE-capable port. Commands you actually use:

! Per-port — set PoE behavior
SW1(config)# interface Gi1/0/1
SW1(config-if)# power inline auto              ! default — detect/classify/deliver
SW1(config-if)# power inline never             ! disable PoE on this port
SW1(config-if)# power inline static            ! reserve full af/at budget regardless

! Limit per-port wattage (handy if you don't trust a third-party PD)
SW1(config-if)# power inline auto max 15400    ! cap at 15.4 W

Global tools:

SW1# show power inline                          ! all ports, all classes
SW1# show power inline Gi1/0/1
SW1# show power inline police                   ! ports configured with budget cap
SW1# show platform software ilpower system 1    ! deep diagnostics

show power inline is the troubleshooting workhorse:

SW1# show power inline
Module   Available   Used   Remaining
------   ---------   ----   ---------
1            445.0  186.2     258.8

Interface  Admin  Oper      Power  Device           Class
---------  -----  --------  -----  ---------------  -----
Gi1/0/1    auto   on        15.4   IP Phone 8841    3
Gi1/0/2    auto   on        30.0   AIR-CAP3702      4
Gi1/0/3    auto   off        0.0   n/a              n/a
Gi1/0/4    auto   on        25.5   AIR-CAP9120      4

Cable considerations

• Cat5e minimum for 802.3af / at. Cat6 minimum recommended for 802.3bt to keep heat manageable.
• Long runs (close to 100 m) lose ~3–5 W to cable resistance. Plan with that.
• PoE doesn’t care about cable shielding (STP vs UTP) electrically, but high-density bt installs prefer shielded cables to reduce alien crosstalk.
• Never use untwisted “flat” Ethernet cables for PoE — heat buildup is real and they can melt.

Common mistakes

1. Over-budgeting the switch. 24-port PoE+ switch with 30 W per port = 720 W theoretical, but the budget is usually ~450 W. Read the spec sheet.

2. Forgetting that AP/camera spec is “peak power.” A camera says 30 W max but sits at 8 W average. Size for peak when sizing budget; size for average when sizing UPS.

3. Assuming UPS is automatic. Putting the switch on a UPS gives you 5–30 minutes of “branch survives a power blip.” You probably need this. Datacenter switches usually have dual power supplies + dual UPSes.

4. Plugging a PoE-injected cable into a PoE switch port. Two PSEs on the same line. Usually fine (each detects no PD and shuts off), but flaky. Pick one.

5. Cable runs longer than 100 m. PoE inherits Ethernet’s 100 m spec. Long cables = voltage drop = device randomly browns out. Use a mid-span injector or PoE extender for runs longer than 100 m.

6. Mixing PoE+ devices on a plain PoE (af) switch. Switch can only deliver 15.4 W; PoE+ device boots in low-power mode (or fails). Always match PD requirement to switch standard.

7. Forgetting LLDP for high-class PDs. 802.3bt Class 5+ devices negotiate exact wattage over LLDP after link-up. If LLDP is disabled on the switch, the PD may not get the extra wattage it asked for.

Real-world troubleshooting

User says: “my new conference-room AP isn’t coming up.”

Step through:

1. show power inline Gi1/0/24 — what does the switch see? Class detected? Power delivered?
2. If Oper off and Device n/a — switch never saw a PD signature. Bad cable, bad patch, bad AP.
3. If Oper power-deny — switch ran out of budget. Move AP to a different switch, or upgrade switch power supply.
4. If Oper fault — AP is drawing more than it negotiated, switch shut it off. Mismatched cable category, run too long, or AP is bt-class on an af-only switch.
5. show cdp neighbor Gi1/0/24 or show lldp neighbors detail — sanity check that the device is actually there.

Lab to try tonight

1. Plug a PoE phone (or AP, camera) into a PoE switch port.
2. show power inline brief — note the class, wattage, device name.
3. Run power inline never on that port. Phone goes dead. Run power inline auto again — phone boots.
4. Cap the port: power inline auto max 7000. If you connect a higher-class device (e.g., AP), the switch refuses with power-deny.
5. Inspect cabling — if you have a spare patch lead and a cable tester, measure pair connectivity. Identify which pairs carry power on your equipment (varies by Mode A vs Mode B for older af).
6. Bonus: connect a non-PoE laptop to a PoE port. Confirm via show power inline that detection fails and no power is delivered. (No, your laptop won’t fry.)
7. Bonus: if you have an 802.3bt-capable AP, enable LLDP power negotiation (lldp run and cdp run globally), reboot the AP, then check the AP’s CLI for actual negotiated wattage.

Cheat strip

Troubleshooting PoE — the common patterns

PD doesn’t power up at all

• show power inline — is the port even attempting to deliver? If Admin=auto but Oper=off, look at detection.
• Cable failure — pair damage often kills PoE first (needs all 4 pairs for 802.3bt; 2 pairs for af/at).
• Wrong port — some switches deliver PoE only on a subset of ports (edge SKUs).
• Budget exhausted — show power inline shows total Available vs Used at the top. If Used ≈ Available, new PDs get “power denied.”

PD flaps under load

• Cable heat — Cat5e on a 100 m PoE+ run can hit spec-limit temperatures. Cat6 fixes it.
• Wrong power class — the PD advertised class 3 (13 W) but actually needs class 4 (25 W). Enable LLDP power negotiation and let the PD ask for its true budget.
• Switch’s power supply sized too small — pulling the transceiver stats, sum the current PoE draw. Compare to PSU capacity.

Wi-Fi AP boots but loses client-serving radio randomly

• Under-powered AP is the classic symptom. A Wi-Fi 6E AP hitting 802.3at (30 W) instead of 802.3bt (60 W) will disable its 6 GHz radio to save budget. Verify with show cdp neighbors detail (AP reports required power) and show power inline on the switch.

PD works on one port, not another

• Not all ports are PoE (check hardware). Also check power inline auto vs never per interface — someone may have disabled PoE on a specific port.

Frequently asked questions

Q: If I plug my laptop into a PoE switch port, will PoE fry it? A: No. PoE uses a resistive signature check (25 kΩ) BEFORE delivering power. Ordinary non-PoE devices don’t present that signature, so the switch withholds power. Your laptop just gets regular Ethernet.

Q: Cat5e for PoE+ — safe or not? A: For short runs (under ~50 m), fine. For 90+ m runs with sustained PoE+ draw (like a Wi-Fi AP under full load), heat buildup is real. Cat6 is the modern safe choice. Cat6A for PoE++ (802.3bt).

Q: How is 802.3bt different from Cisco UPOE? A: Cisco UPOE (60 W) and UPOE+ (90 W) predated the 802.3bt standard. Same power classes, similar behavior. Modern Catalyst switches implement true 802.3bt so they work with any PD, not just Cisco.

Q: How do the switch and PD agree on wattage? A: Two-tier: first the class check at power-on (rough — 4 classes for 802.3af/at, 8 classes for 802.3bt). Then LLDP-MED power negotiation refines it. Enabling lldp run globally lets a Wi-Fi AP request its exact budget instead of getting a class-based approximation.

Q: Can PoE run over fiber? A: No — PoE is inherently a copper-only technology because power needs conductors. If your uplink is fiber, use a media converter with a PoE-out port, or place the PD close enough that a copper drop works.

Q: What’s “Perpetual PoE”? A: Cisco Catalyst feature (also called “Fast PoE” on some SKUs) that keeps PoE flowing through a brief switch reload. Prevents PoE devices (IP phones, APs) from rebooting when the switch does. Useful in mission-critical environments.

Q: Do all 8 ports on a PoE switch always run at max power together? A: No — that’s what “power budget” is about. An 8-port switch with a 250 W budget can power six APs at 30 W each (180 W) but only four at 60 W (240 W). Anything beyond the budget is refused.

Q: PoE ↔ MPS ↔ what does the switch drop power when the device is unplugged? A: MPS (Maintain Power Signature) is a low-level continuous check. If the PD disappears, MPS timeout expires and the switch cuts power. Prevents the port from constantly reheating with no device attached.

Q: What’s the max distance for PoE? A: Same as Ethernet — 100 m over Cat5e/6/6A. Beyond that you need a PoE injector, midspan, or a switch acting as a repeater. Some vendors sell “PoE Extenders” that go 200–400 m at reduced bandwidth.