A 48-port PoE+ switch does not have 48 PoE+ ports. It has 48 ports that can each negotiate PoE+, and a power supply that decides how many of them get it. On the ones I see specified for camera networks, the supply is sized for somewhere between a third and half of the ports at full draw, and the other half get whatever is left. That is fine if someone did the arithmetic. It is a slow-motion outage if nobody did, because the switch will happily bring up every camera at commissioning, and then start dropping the ones at the bottom of its priority list on the first cold night when the heaters come on.
This page is the arithmetic, and the failure modes that follow skipping it.
What the standards actually deliver
The number on the datasheet is power at the switch port. The number that matters is power at the device, after the cable has taken its share. The standards define both.
| Standard | Type / class | At the port (PSE) | At the device (PD) | Pairs | Typical loads |
|---|---|---|---|---|---|
| 802.3af | Type 1, classes 0 to 3 | 15.4 W | 12.95 W | 2 | Fixed cameras, readers, small panels |
| 802.3at | Type 2, class 4 | 30 W | 25.5 W | 2 | PTZ, multi-sensor, cameras with IR |
| 802.3bt | Type 3, classes 5 and 6 | 60 W | 51 W | 4 | PTZ with heater, large multi-sensor, door controllers |
| 802.3bt | Type 4, classes 7 and 8 | 90 W | 71.3 W | 4 | Heated speed domes, thin clients, lighting |
The gap between the two columns is cable loss at the standard’s worst-case 100 metre channel. On a 30 metre run the device sees more than the table says; on a run near the limit it sees exactly the table and no more. A camera rated for 24 W on a 95 metre run of marginal Category 5e is a camera that reboots when its IR turns on.
Class matters for budgeting because the switch reserves power by class at negotiation, not by what the device actually draws. A class 4 device that draws 14 W in practice still reserves 30 W at the port until LLDP or the vendor’s proprietary negotiation trims it. Some switches trim; many do not by default.
The power supply sets the budget
The switch’s total PoE budget is what its power supply can deliver to the ports after the switch itself has taken what it needs to run. That figure is on the datasheet, usually somewhere below the headline port count, and it is the only number that decides how many devices the switch can actually power.
48-port “PoE+” access switch, single 370 W supply 48 ports × 30 W reserved at class 4 = 1,440 W required Budget available = 370 W Ports that get full PoE+ = 12
Twelve. The other thirty-six negotiate down, get lower classes, or get nothing, depending on the priority configuration. The same chassis with a 740 W supply powers 24. With dual 740 W supplies in a combined mode, closer to 48, and with dual supplies in a redundant mode, back to 24, because the second supply is there for when the first fails, not to add budget.
This is the point that gets missed on drawings: the quantity and size of the power supplies installed decides the PoE capacity, not the model number of the switch. A switch specified by model with the supply left to “as standard” has a budget nobody chose. Specify the supply, specify whether the second supply is for redundancy or for capacity, and write the resulting budget on the drawing next to the switch.
Counting the load
Add up the devices by class, at the class they will negotiate, not at their idle draw. Then apply the things the class table does not show.
- Heaters and blowers. A camera that is class 4 in summer is class 6 in winter when the housing heater runs. The datasheet will say so in the small print. Budget for the winter figure.
- Infrared. IR illuminators draw at night. A camera’s peak draw is at 02:00 in January with IR on and the heater running, which is precisely when you most want it recording.
- PTZ motion. A dome drawing 12 W at rest draws considerably more during a pan. Budget the peak.
- Access control. A reader is small. A PoE door controller running a maglock and a REX from its own PoE budget is not, and a class 6 controller is now common. Locks on the controller’s PoE are also locks that release when the switch reboots, which is a design decision, not an accident.
- Growth. Every camera network I have audited has more cameras than the drawing it was built from. Leave 20 percent of the budget unallocated at commissioning.
- Cable. Runs over 70 metres, runs on Category 5e, and runs through patch panels with more than two connections between switch and device all lose more power. The standard already assumes worst case; the device’s own rating may not.
Worked example, one IDF: 22 fixed cameras, class 3 22 × 15.4 W = 339 W 6 multi-sensor with IR, class 4 6 × 30 W = 180 W 4 PTZ with heater, class 6 4 × 60 W = 240 W 8 door controllers, class 4 8 × 30 W = 240 W Reserve for growth, 20 percent = 200 W
Budget required 1,199 W Two 740 W supplies, combined mode 1,480 W fits Two 740 W supplies, redundant mode 740 W does not
LLDP and what the switch reserves
The physical-layer classification at power-up is coarse. LLDP-MED, and vendor extensions such as Cisco’s CDP power negotiation, let the device tell the switch precisely what it needs, and let the switch reserve that rather than the class maximum. On a switch with a tight budget this is the difference between powering 30 cameras and powering 22.
Enable LLDP on every camera port and confirm the cameras speak it; most current models do. Then check what the switch is reserving against what the devices are drawing:
! Cisco Catalyst
show power inline
show power inline interface GigabitEthernet1/0/12 detail
# Aruba CX
show power-over-ethernet brief
show power-over-ethernet interface 1/1/12
! Alcatel-Lucent OmniSwitch
show lanpower slot 1/1
A port showing 30 W allocated for a device drawing 8 W is a device that is not negotiating. Either LLDP is off on one end, or the device only classifies at the physical layer, or the switch is configured to ignore negotiation and allocate by class. All three are fixable and the budget you recover is real.
Priority, and what goes dark first
When the budget runs out the switch sheds load. Which ports it sheds is set by the per-port PoE priority, and the default on most platforms is that every port is the same priority and the highest-numbered ports lose first. Nobody plans their camera layout around port numbering, so the cameras that go dark are whichever ones the installer patched last.
Set priority deliberately. Critical on the perimeter and the door controllers, high on the cameras covering egress and cash, low on the ones covering the staff car park. Then when the budget is short, the loss is the one you chose.
! Cisco Catalyst: critical, high, low
interface GigabitEthernet1/0/1
power inline port priority critical
# Aruba CX
interface 1/1/1
power-over-ethernet priority critical
And configure the switch to alert when the budget is over a threshold. Most platforms will raise a trap or a syslog message at a configurable percentage of budget. Route it to whoever watches the network, because a switch at 95 percent of its PoE budget is one heater away from shedding a camera, and a shed camera on a healthy network link looks, to the VMS, like a camera that broke.
Failure modes
| What is reported | What is usually wrong |
|---|---|
| Cameras drop at night in winter, fine by day | Budget exceeded when IR and heaters come on. Check the PoE log for the time of the drops. |
| One camera reboots when it pans or when IR triggers | Long or poor cable; device sees less than its rating at peak. Move it to a bt port, shorten the run, or accept a lower class. |
| New cameras come up, older ones start dropping | Budget was full; priority is default; highest-numbered ports lost. |
| Half the switch loses PoE at once | One of two supplies failed and the pair was in combined mode. The budget halved. |
| Doors fail open or fail secure during a switch reboot | Locks on the door controller’s PoE. Decide whether that is intended; if not, locks need a supervised power supply of their own. |
| Camera draws more than the port allows and the port shuts down | Device class above port capability, usually a bt camera on an at port. Match the port to the device. |
Design checklist
- Load counted by class at winter peak, with IR, heaters, PTZ motion, and door controllers included.
- 20 percent of budget reserved at commissioning.
- Power supplies specified by quantity and size, and the mode, combined or redundant, decided and written on the drawing.
- Budget available compared to budget required, per switch, on the drawing.
- LLDP enabled on camera ports; switch allocating by negotiation rather than by class.
- Port priority set by what the camera covers, not by port number.
- PoE budget threshold alert configured and routed.
- Cable runs over 70 metres and any Category 5e runs flagged against the device’s rating at the device.
- Locks on PoE door controllers identified, and the behaviour on switch power loss decided.
The rest of the camera VLAN configuration, including the PoE lines in context, is in the Cisco, Aruba CX, and OmniSwitch templates.