Power over Ethernet (PoE): Standards, Classes, and the Budget That Bites

Every access point, IP phone, and security camera on your network probably has no power cable. Power over Ethernet delivers DC power over the same twisted pair carrying data, and CCNA objective 1.3 expects you to know the concepts: the standards, the wattage classes, how negotiation works, and what happens when a switch runs out of power budget. Here's the practical version.

Why PoE exists

The alternative to PoE is an electrician. Every AP on a ceiling, every camera on a pole, every phone on a desk would need a mains outlet installed next to it. PoE turns power delivery into a patching problem instead of a construction problem, and it centralizes power backup: put the switch on a UPS and every phone stays up through an outage - the reason VoIP deployments made PoE mainstream.

The standards and their budgets

The port-versus-delivered distinction matters: copper has resistance, and the standard guarantees delivered wattage at 100 meters. Spec sheets quote the bigger number; the device sees the smaller one.

How a port decides to send power

The switch (PSE, power sourcing equipment) will not blast 30 watts into a random laptop NIC. Negotiation happens in stages:

1. Detection: the PSE applies a tiny probe voltage looking for the 25kΩ signature resistor that all powered devices (PDs) carry. No signature, no power - which is why plugging your laptop into a PoE port is safe.
2. Classification: a second probe reads the PD's class (0 through 8), a rough "how much do I need" declaration. Class 3 asks for 802.3af levels, class 4 for PoE+, classes 5-8 for the 802.3bt tiers.
3. Negotiation refinement: after link-up, CDP or LLDP lets the device request its actual operating wattage - a Cisco AP might classify at 30W but settle to 21W once booted. This is why show power inline often shows less than the class maximum.

The power budget: where PoE bites

Every PoE switch has a total power supply budget, and it's rarely ports-times-maximum. A 48-port switch with a 740W supply can do 15.4W on all 48 ports (740 ÷ 48), but only ~24 ports of full 30W PoE+. The switch allocates on request and refuses new PDs once the budget is spent - so the 25th access point simply doesn't power on, even though the port works fine for data. On Cisco gear the commands to know are:

show power inline            ! per-port draw, class, and remaining budget
show power inline  detail
power inline static max 30000   ! reserve wattage for a critical device

Design rules of thumb: total your PD wattage at their class maximums, add headroom for growth, and check the budget before the Wi-Fi refresh doubles every AP's draw - the Wi-Fi 6 upgrade that dies mysteriously at the 30th AP is a budget problem, not a wireless problem. (This is a concept article by design - our CML lab is virtual and can't source real power, so no captured output here; the commands above are the ones to run on physical Catalyst gear.)

Odds and ends the exam likes

• Inline power is DC, nominally around 54V, current-limited - not mains electricity down your patch cable.
• Injectors and splitters retrofit PoE onto non-PoE links for one device at a time; fine for a lab, messy at scale.
• Perpetual/fast PoE keeps or restores power during a switch reload so cameras and badge readers don't blink when you upgrade IOS.
• Power policing (power inline police) errdisables a port drawing more than it negotiated - worth enabling where third parties plug things in.

FAQ

What is the difference between PoE and PoE+?

Wattage and class. PoE (802.3af, Type 1) sources up to 15.4W per port, delivering about 12.95W after cable loss; PoE+ (802.3at, Type 2) doubles that to 30W sourced / 25.5W delivered. PoE+ ports are backward compatible - an af device on an at port simply classifies lower and draws what it needs.

Can PoE damage a non-PoE device?

No, and this is by design. The PSE probes for the 25kΩ signature resistor before applying meaningful power. A laptop, printer, or old switch without the signature never receives voltage beyond the harmless detection probe. Passive PoE injectors (non-standard, always-on) are the exception - those can cook things, which is why standards-based gear is worth insisting on.

Why won't my access point power on when the port shows connected?

Usual suspects in order: the switch's remaining power budget can't cover the AP's class (check show power inline - budget, not port count, is the limit); the AP needs PoE+/802.3bt but the switch is af-only; a long or marginal cable can't deliver the wattage; or the port has a static power cap set below the AP's requirement. Data link-up only proves the pairs carry signal, not watts.

How far can PoE run?

Same as Ethernet: 100 meters over copper, and the standards guarantee delivered wattage at that distance. PoE extenders and PoE-over-fiber solutions (media converter with local power injection) handle longer runs like parking-lot cameras.

What is UPoE and is it the same as 802.3bt?

UPoE was Cisco's pre-standard 60W four-pair implementation; UPoE+ pushed 90W. 802.3bt standardized the same power levels as Type 3 (60W) and Type 4 (90W), and current Catalyst gear implements the standard. Treat the Cisco names as historical labels for bt-class power.

Key takeaways

• af = 15.4W, at = 30W, bt = 60/90W. Two pairs up to PoE+, four pairs for 802.3bt.
• Detection (signature resistor) then classification (class 0-8) then CDP/LLDP refinement. Non-PD devices never receive power.
• The per-switch power budget, not the per-port maximum, is what limits real deployments. show power inline is the tool.
• Delivered wattage is lower than port wattage - the spec guarantees delivery at 100m of cable.

Related: Networking Interfaces and Cables Explained for the physical layer underneath, the WLC guide for what you're usually powering, and the Network Fundamentals guide for the domain map.