Power over Ethernet (PoE)

Mental model

A Cat5e/6 cable has 4 twisted pairs (8 wires). Standard 10/100 Ethernet only uses 2 of those pairs for data. Gigabit uses all 4 but only at a fraction of their voltage capacity.

PoE uses the same cable to carry 48 V DC to the connected device on top of the data. The receiving device (an IP phone, AP, camera) extracts the power and runs from it.

Why this matters in practice:

• One cable, no power adapter — IP phones, APs, badge readers, cameras all install without an electrician.
• One power budget at the switch — back up the wiring closet with one UPS, all PoE devices stay up during a power outage.
• Centralized control — switch can power-cycle a stuck AP or phone from a CLI.

If you’ve never wondered how the AP in your office ceiling gets power, the answer is: PoE from the switch.

The IEEE standards

Standard	Marketing name	Year	Max watts (at the PD)	Cable use
802.3af	PoE	2003	12.95 W (delivered), 15.4 W (sourced)	2 pairs
802.3at	PoE+	2009	25.5 W (delivered), 30 W (sourced)	2 pairs
802.3bt Type 3	PoE++ / 4PPoE	2018	51 W (delivered), 60 W (sourced)	All 4 pairs
802.3bt Type 4	PoE++ / UPOE+	2018	71.3 W (delivered), 90 W (sourced)	All 4 pairs

Each standard supersedes but is backwards compatible with the older ones. An 802.3bt switch can power an 802.3af phone without issue.

There are also proprietary pre-standards — Cisco UPOE (60W), Cisco UPOE+ (90W). Same delivered power as 802.3bt but pre-dated the standard. Modern switches use the standard.

Watts to know:

• A typical Wi-Fi 6 AP needs ~25 W → PoE+ minimum.
• A high-end Wi-Fi 6E AP with multi-gig uplink can need 30–60 W → 802.3bt.
• A standard IP phone needs ~6 W → plain PoE is fine.
• A pan/tilt camera with IR + heater needs ~25–60 W → PoE+ or bt.

Roles — PSE and PD

Term	What it means
PSE	Power Sourcing Equipment — the device delivering power. Usually a switch port; can be a “PoE injector” mid-span.
PD	Powered Device — the device receiving power. Phone, AP, camera.

A PoE injector is a small box that adds PoE to a non-PoE switch’s port — useful for one-off retrofits. A PoE splitter does the reverse on the PD side (delivers power and data separately to a device that doesn’t natively support PoE).

The negotiation — why you can plug your laptop into a PoE port safely

A PSE doesn’t just blast 48 V down the cable. It runs a detection and classification sequence first:

1. Detection — PSE applies a small voltage (2.7–10 V) and measures resistance. A real PD has a specific 25 kΩ signature resistor across the right pins. A laptop or random Ethernet device doesn’t → PSE sees no signature → never delivers power.

2. Classification — PD signals its class (0–8) by drawing a specific current under low voltage. Class maps to power range. PSE allocates from its budget accordingly.

Class	Sourced power	Common PDs
0	15.4 W (af legacy default)	Old VoIP phones
1	4.0 W	Sensors
2	7.0 W	Basic phones
3	15.4 W	Most APs, fancy phones
4	30 W	Wi-Fi 6 APs
5	45 W	High-power APs, cameras
6	60 W	Type-3 802.3bt
7	75 W	Higher-power Type-4
8	90 W	High-density APs, video kiosks

3. Power delivery — once class is known and budget exists, PSE engages 48 V on the chosen pairs.

4. Continuous monitoring — PSE keeps detecting the PD’s “MPS” (Maintain Power Signature). If the PD goes away (cable unplugged), PSE shuts power within 300–400 ms.

5. LLDP-based negotiation (Cisco UPOE / 802.3bt). After the basic class, PD and PSE can negotiate a more precise wattage over LLDP — useful for class-4+ devices that want more than 30 W but only sometimes.

Power budgets — the gotcha that kills branch offices

A switch has a finite total PoE budget. Common values:

Switch	Total PoE budget
Catalyst 9300-24P	445 W
Catalyst 9300-24UPOE	715 W
Catalyst 9300-48P	822 W
Catalyst 9300-48UPOE	1100 W
Catalyst 9200-24P	370 W

If you have a 24-port switch with 445 W budget and 24 Wi-Fi 6 APs at 25.5 W each → 612 W demanded → switch refuses to power all of them. Some ports stay dark.

Standard practice: when sizing a switch, calculate (number of PDs × max watt per PD) × 1.2 safety margin and pick a switch with that total budget.

Configuration — Cisco IOS

PoE is usually on by default on every PoE-capable port. Commands you actually use:

! Per-port — set PoE behavior
SW1(config)# interface Gi1/0/1
SW1(config-if)# power inline auto              ! default — detect/classify/deliver
SW1(config-if)# power inline never             ! disable PoE on this port
SW1(config-if)# power inline static            ! reserve full af/at budget regardless

! Limit per-port wattage (handy if you don't trust a third-party PD)
SW1(config-if)# power inline auto max 15400    ! cap at 15.4 W

Global tools:

SW1# show power inline                          ! all ports, all classes
SW1# show power inline Gi1/0/1
SW1# show power inline police                   ! ports configured with budget cap
SW1# show platform software ilpower system 1    ! deep diagnostics

show power inline is the troubleshooting workhorse:

SW1# show power inline
Module   Available   Used   Remaining
------   ---------   ----   ---------
1            445.0  186.2     258.8

Interface  Admin  Oper      Power  Device           Class
---------  -----  --------  -----  ---------------  -----
Gi1/0/1    auto   on        15.4   IP Phone 8841    3
Gi1/0/2    auto   on        30.0   AIR-CAP3702      4
Gi1/0/3    auto   off        0.0   n/a              n/a
Gi1/0/4    auto   on        25.5   AIR-CAP9120      4

Cable considerations

• Cat5e minimum for 802.3af / at. Cat6 minimum recommended for 802.3bt to keep heat manageable.
• Long runs (close to 100 m) lose ~3–5 W to cable resistance. Plan with that.
• PoE doesn’t care about cable shielding (STP vs UTP) electrically, but high-density bt installs prefer shielded cables to reduce alien crosstalk.
• Never use untwisted “flat” Ethernet cables for PoE — heat buildup is real and they can melt.

Common mistakes

1. Over-budgeting the switch. 24-port PoE+ switch with 30 W per port = 720 W theoretical, but the budget is usually ~450 W. Read the spec sheet.

2. Forgetting that AP/camera spec is “peak power.” A camera says 30 W max but sits at 8 W average. Size for peak when sizing budget; size for average when sizing UPS.

3. Assuming UPS is automatic. Putting the switch on a UPS gives you 5–30 minutes of “branch survives a power blip.” You probably need this. Datacenter switches usually have dual power supplies + dual UPSes.

4. Plugging a PoE-injected cable into a PoE switch port. Two PSEs on the same line. Usually fine (each detects no PD and shuts off), but flaky. Pick one.

5. Cable runs longer than 100 m. PoE inherits Ethernet’s 100 m spec. Long cables = voltage drop = device randomly browns out. Use a mid-span injector or PoE extender for runs longer than 100 m.

6. Mixing PoE+ devices on a plain PoE (af) switch. Switch can only deliver 15.4 W; PoE+ device boots in low-power mode (or fails). Always match PD requirement to switch standard.

7. Forgetting LLDP for high-class PDs. 802.3bt Class 5+ devices negotiate exact wattage over LLDP after link-up. If LLDP is disabled on the switch, the PD may not get the extra wattage it asked for.

Real-world troubleshooting

User says: “my new conference-room AP isn’t coming up.”

Step through:

1. show power inline Gi1/0/24 — what does the switch see? Class detected? Power delivered?
2. If Oper off and Device n/a — switch never saw a PD signature. Bad cable, bad patch, bad AP.
3. If Oper power-deny — switch ran out of budget. Move AP to a different switch, or upgrade switch power supply.
4. If Oper fault — AP is drawing more than it negotiated, switch shut it off. Mismatched cable category, run too long, or AP is bt-class on an af-only switch.
5. show cdp neighbor Gi1/0/24 or show lldp neighbors detail — sanity check that the device is actually there.

Lab to try tonight

1. Plug a PoE phone (or AP, camera) into a PoE switch port.
2. show power inline brief — note the class, wattage, device name.
3. Run power inline never on that port. Phone goes dead. Run power inline auto again — phone boots.
4. Cap the port: power inline auto max 7000. If you connect a higher-class device (e.g., AP), the switch refuses with power-deny.
5. Inspect cabling — if you have a spare patch lead and a cable tester, measure pair connectivity. Identify which pairs carry power on your equipment (varies by Mode A vs Mode B for older af).
6. Bonus: connect a non-PoE laptop to a PoE port. Confirm via show power inline that detection fails and no power is delivered. (No, your laptop won’t fry.)
7. Bonus: if you have an 802.3bt-capable AP, enable LLDP power negotiation (lldp run and cdp run globally), reboot the AP, then check the AP’s CLI for actual negotiated wattage.

Cheat strip

Concept	Plain English
PSE	Power Sourcing Equipment — the switch port
PD	Powered Device — phone, AP, camera
802.3af	Original PoE — 15.4 W sourced
802.3at	PoE+ — 30 W sourced
802.3bt Type 3 / 4	PoE++ — 60 W / 90 W sourced
Detection	Switch checks for the 25 kΩ signature before delivering power
Classification	PD declares its power class (0–8)
Power budget	Total watts a switch can deliver across all PoE ports
MPS	Maintain Power Signature — PSE drops power if PD vanishes
power inline auto	Default — detect, classify, deliver
power inline never	Disable PoE on this port
show power inline	Per-port wattage, class, device — your main troubleshooting view
Cable	Cat5e minimum for af/at; Cat6 recommended for bt
100 m limit	Same as Ethernet. Beyond that → injector / extender