An access point that reboots every forty minutes looks like a firmware bug. It is usually arithmetic: the switch's power budget is smaller than the sum of what its ports are asking for, and the port with the lowest priority gets cycled to keep the rest online.
PoE is one of the few places in networking where the constraint is physical, measurable, and easy to get wrong at purchase time.
Two devices, one cable
Power over Ethernet puts DC voltage on the same pairs that carry data. The switch (or injector) is the PSE, power sourcing equipment. The device is the PD, powered device — an AP, phone, camera, or door controller.
Before power flows, the PSE performs detection: it applies a small voltage and looks for a 25 kΩ signature. A laptop NIC does not have one, so it never receives power. This is why plugging a laptop into a PoE port is harmless, and why a damaged PD sometimes draws nothing at all.
After detection, the two ends negotiate a class, which tells the PSE how much power to reserve.
| Standard | Name | PSE output | PD receives | Typical device |
|---|---|---|---|---|
| 802.3af | Type 1 | 15.4 W | 12.95 W | Phones, basic APs |
| 802.3at | Type 2 | 30 W | 25.5 W | Wi-Fi 5/6 APs, PTZ cameras |
| 802.3bt | Type 3 | 60 W | 51 W | Wi-Fi 6E APs, video phones |
| 802.3bt | Type 4 | 90 W | 71 W | Displays, high-power APs |
The gap between what the switch outputs and what the device receives is cable loss. At 100 meters on 24 AWG cable, that loss is real and it is why the numbers are not the same on both sides of the table.
The budget is the whole design
A 48-port switch might advertise 740 W total, with 30 W available per port. Those two numbers cannot both be true at once: 48 × 30 W is 1,440 W. The switch allocates power dynamically and refuses to power a port that would exceed the total.
That refusal is the failure mode to plan for.
Worked example
A closet switch with a 740 W budget serves:
| Device | Count | Class | Reserved each | Total |
|---|---|---|---|---|
| Wi-Fi 6 APs | 20 | 4 (802.3at) | 25.5 W | 510 W |
| VoIP phones | 12 | 2 | 6.5 W | 78 W |
| Cameras | 8 | 3 | 12.95 W | 103.6 W |
| Door controller | 1 | 3 | 12.95 W | 12.95 W |
| Total | 704.55 W |
704 of 740 W is 95% committed. It works today, and it fails the moment someone adds a 21st access point. The correct design leaves 20-30% headroom for exactly that reason, which means this closet needs a second switch or a higher budget before the next AP, not after.
Never size PoE to the nameplate
"740 W" is the switch's capacity, not its capability in your closet. Sum the class-based reservations for every port you intend to power, add 25%, and compare. Vendors publish per-port and total budgets separately for a reason.
Classes, LLDP, and the two-event handshake
Classic PoE uses a resistor to signal class. 802.3at and bt add LLDP (or CDP) negotiation, where the device asks for a specific allocation and the switch agrees or refuses. This is how a Wi-Fi 6E AP that needs 51 W gets it, and how the switch avoids reserving 90 W for a phone.
If LLDP is disabled on the switch, high-power devices fall back to their hardware class and may be refused. That is a common cause of "the new AP works on one switch and not another."
What breaks in production
- Budget oversubscription. The switch cycles low-priority ports to stay within its total. Symptom: a device reboots on a schedule, and the switch log shows power denial rather than a link failure.
- Passive 24 V PoE. Some older access points use passive PoE that is not 802.3af/at. Plugging them into a standards-based port gives no power, or damages the device. Check the label before assuming compatibility.
- Cable resistance. A long run on 24 AWG cable drops enough voltage that a Type 2 device renegotiates as Type 1 and boots into a degraded mode, or reboots under load.
- Inrush current. A device with a large capacitor draws a surge at power-on. Several booting at once after an outage can trip the switch's per-port protection.
- UPS runtime. PoE load counts against the UPS. A closet with 700 W of PoE and a 1500 VA UPS has minutes, not hours, unless the budget was sized for it.
Checklist
- Total committed PoE is under 75% of the switch's budget.
- Every device's class is known, not assumed from its model number.
- LLDP is enabled on ports serving 802.3at/bt devices.
- Cable runs are under 100 m and the gauge is documented.
- UPS runtime is calculated with PoE load included.
- Port power priority is set so that APs survive before phones do — or the reverse, deliberately.
Next
You can now follow a frame through a switch, survive a loop, bundle an uplink, and power the gear on the other end. That is the campus LAN.
The next series leaves the closet for the air: Enterprise Wi-Fi — bands, channels, airtime, and site surveys, leading into the two advanced RF articles already published. It is being written now; the ladder is on the series page.