802.3af Power Over Ethernet

Power over Ethernet, or PoE is a system which transfers electrical power to remote devices like VoIP phones or 802.11 access points over standard Ethernet cables. PoE provides many advantages to network administrators. Powered devices don’t need to be located next to an A/C outlet. They can be anywhere an Ethernet cable can be run (within 328 feet of the nearest Ethernet switch). Because 802.3af is low-voltage, it is subject to less-strict standards under the National Electrical Code. Whereas a licensed electrician would be required to run 120-volt A/C power, any Ethernet cable installer can pull Cat-5 for PoE. This can significantly lower the cost of an installation. It will often be the case that a PoE device can be remotely power-cycled by logging into the Ethernet switch that provides the power. This is typically not the case for A/C powered devices. Finally, PoE infrastructures simplify the wiring plan by cutting in half the number of cables that must be run and plugged in in the wiring closet. With PoE, only data cables must be run, as opposed to data plus power.

Power-Sourcing Equipment

The powered device (PD) receives power. The device that provides power is known as the Power-Sourcing Equipment (PSE). The two types of PSE are end-point and mid-span. And end-point PSE is an Ethernet switch with PoE circuitry built in. This means that you can simply plug a PD into the switch the same as any other Ethernet device, and the switch will provide power. In some cases, however, a PoE-capable Ethernet switch is not available, or would be overkill to power just one or two devices. Mid-span power injectors are used in these cases. Injectors plug in between the Ethernet switch and the PD. A “power brick” plugs the injector into an AC outlet and the injector converts the power to DC and puts the power onto the Ethernet cable.

It should be noted that PoE-enabled switches usually don’t provide power to all of their ports. Manufacturers expect that not all devices plugged into the switch will require power, so they lower costs by not putting PoE circuitry on all ports. Most PoE switches are capable of providing power to half of their ports. Therefore, an 8-port switch could typically support up to 4 powered devices; a 16-port switch, 8 powered devices, and so forth. In some cases, half the ports will be designated “Powered” and half, “Unpowered”. In other cases, all ports will be capable of providing power, but only half of them at a time.

There are some exceptions. Some switches can provide power to 100% of their ports. These switches may not be cost-effective unless you expect more than 50% of the devices on a switch to be powered. The convenience of not having to worry about the number of powered ports you have available might be worth the additional cost to you.

The choice between a PoE-enabled switch and a PoE injector is usually pretty clear. PoE switches are almost always preferable to injectors. Injectors are just one more device to clutter up the wiring closet, and each one requires a separate AC outlet and an additional patch cable to connect it to the Ethernet switch. Additionally, PoE switches often have the ability to remotely power-cycle individual ports, which can enhance the ability to remotely manage the network. The only down-side of a PoE switch is cost. Even a low-end PoE switch runs between $200 and $300, while a single PoE injector typically runs about $50.

Power Budget

Switches that can provide power to all ports may be further constrained by their power budget. The power budget is the maximum wattage that the switch can provide. A 802.3af PSE is required to provide up to 15.4 watts to a single port, but many devices use less power than this. For example, an 802.11 access point might only draw 3 or 4 watts. Consider the case of an 8-port PoE switch. The manufacturer might install a power supply rated for 15.4 watts / port * 4 ports = 61.6 watts. The switch can provide full power to only four of its eight ports, a typical 50% capacity. The manufacturer might put PoE circuitry on all eight ports, without increasing the power supply’s capacity. This means that, as long as the total power drawn by the powered devices doesn’t exceed 61.6 watts, it doesn’t matter which port(s) the devices are plugged into. If at any point, the sum total wattage drawn by the powered devices would exceed 61.6 watts, then additional devices that are plugged in simply won’t power up. Because few PoE devices pull the maximum allowable wattage, this is a good way of increasing value to the customer without increasing the cost of the device too much. Keep in mind, however, that many switches, especially lower-end ones, simply allocate a fixed wattage to each powered port, and leave it at that. Any un-used capacity is wasted and is not available at the other ports.

802.3af-compliant PoE injectors from PowerDsine. Multi-port and single-port.

Proprietary power injector from Ubiquiti networks simply bridges DC voltage onto the Ethernet cable. Nothing about this injector gives away the fact that it is not 802.3af-compliant and only works with Ubiquiti radios.

Basic PoE Troubleshooting

From the network administrator’s perspective, PoE is usually pretty simple. Plug the powered device into the Ethernet cable, plug the Ethernet cable into the Power-Sourcing Equipment (PSE), the equipment powers up, and that’s all there is to it. However, there are some things to be aware of.

First, not all PoE is 802.3af-standard PoE. Before the 802.3af standard was finalized, vendors developed proprietary forms of PoE, and some of these are still found in the field—most notably, Cisco’s version. Cisco-proprietary PoE is most likely to be found in Cisco VoIP phones and access points. When these devices are plugged into a Cisco switch, there is no problem, but if they are plugged into an 802.3af-compliant PSE, they may not power up, depending on whether they also support 802.3af PoE. Many switches are capable of providing either Cisco or 802.3af PoE, and many powered devices are capable of operating off of either type, in which case incompatibility is not an issue. Power injectors, on the other hand, typically only provide one type of PoE, and must be matched up with the correct type of PD.

Both Cisco and 802.3af PSEs have some logic built in that allows them to determine whether a PD is present, so as to avoid sending DC current to a device that is not built to receive it. There is a third type of non-standard PoE “injector” that simply bridges DC current from the AC/DC “power brick” onto the unused Ethernet pairs. As long as the cable is plugged in, voltage is present. Because the power is placed on the unused Ethernet pairs, un-powered Ethernet devices should not be damaged if they are plugged in to the adapter, but damage could occur if a powered device is plugged into this type of injector, because the voltage that the injector puts out may not be what the device is expecting. For example, a device that’s expecting 12 volts might be plugged into a 24-volt injector, damaging its circuitry.

The bottom line is this: any 802.3af PD is fine to use with any 802.3af PSE (injector or switch), but non-802.3af injectors should only be used with their intended device. If you are not sure what type of injector you are dealing with, do not use it because you could damage your PD. It is not always obvious from the outside what type of power injector you are dealing with or whether it is 802.3af-compliant, so you may need to call the manufacturer to be sure. Additionally, a PoE diagnostic tool can be used to confirm the voltage that a PSE is putting out. This will be discussed in more detail in the Technology and Engineering section.

Power Over Ethernet Specifications

PoE is implemented based on the specifications in IEEE standard 802.3af-2003. This allows a PoE powered device (PD) to use a voltage between 44-57 Volts DC. Nominal voltage is 48V. Electrical current is transferred over two of the four available pairs on an Ethernet cable with a maximum load of 15.4W. Because of voltage drop over the length of the cable, only about 12.95W are actually available to the PD. The available power is not an issue for a typical VoIP phone or 802.11b/g access point, but it can become an issue for devices with higher power consumption, like multi-radio 802.11n access points, or outdoor devices with a heater integrated into their enclosure. Some of these devices use a proprietary form of PoE to deliver more power. Other devices have a 2 nd Ethernet port, used solely to deliver an additional 15.4 watts of power.

An Ethernet cable has eight wires twisted into four pairs. 100 Mbps Ethernet only uses two of these pairs (referred to as the “data pairs”), with the remaining two pairs unused. Gigabit Ethernet, when run over twisted-pair, uses all four pairs for data. 802.3af devices are capable of receiving power on either the data pairs or the unused pairs. The choice of where to put the power depends on the Power-Sourcing Equipment (PSE). At first, it might seem like the power would interfere with the data signals, but the DC PoE voltage actually doesn’t affect the reception of the AC signal at all. For 100 Mbps devices, the difference between data pairs and unused pairs is inconsequential, but the ability to put power on data pairs is essential for Gigabit, since all pairs are data pairs in a Gigabit link. PoE devices are often built to receive voltage on either set of pairs. Some devices can only receive voltage on the data pairs and not the unused pairs, or vice versa, but this doesn’t create troubleshooting issues, because all 802.3af PSEs can put data on either set of pairs. Whichever pair(s) the PD supports, the PSE can provide power.

Putting voltage onto the data pairs of a non-PoE device would damage the device, as excess current would flow into the Ethernet chipset. Putting voltage onto the unused pairs of a non-PoE device should not damage the device, since the unused pairs are not typically electrically connected to the Ethernet chipset of a non-PoE device. A phantom power technique is used to determine whether an PD is connected to the PSE, in order to avoid sending power to, and damaging, non-PoE devices. This means that you don’t have to worry about plugging non-PoE devices into PoE-enabled Ethernet switches. The switch will detect that the device is not PoE-compliant and won’t send any current. That assumes that you’re talking about an 802.3af switch! You should be careful when plugging devices into devices that may not be 802.3af-compliant, as they may not go through the phantom power check, and there is a small chance that they will damage the device.

When power is placed on the data pairs, 802.3af specifies whether the PD should get positive voltage on the TX pair and negative voltage on the RX pair, or vice versa. In order to meet this requirement, the PSE must know whether a crossover cable is in use, since the presence of a crossover cable will reverse the location of the TX and RX pairs. When the PSE is an Ethernet switch, this is not a problem, as modern Ethernet switches can detect the presence of a crossover cable. But if the PSE is a midspan power injector, there is no way for it to know whether a crossover cable is present. This means that midspan injectors cannot put power onto the data pairs—only the unused pairs. One effect of this is that you can’t use midspan injectors with Gigabit devices. (Actually, that used to be true, but some vendors now make Gigabit-compatible midspan injectors.) A second effect would be if, for some reason, you were only using a two-pair Ethernet cable, you would not be able to use midspan injectors.

PoE Diagnostics

When PoE isn’t working right, most often the PD simply doesn’t power up. Or it powers up, but then doesn’t work. Or it reboots itself constantly. Troubleshooting these situations can be a frustrating game of cat-and-mouse: is it the PD, the cable, or the PSE?! Various diagnostic tools can greatly simplify the troubleshooting process.

First, you should check the manual of your Ethernet cable tester. Many mid- to high-end cable testers do basic PoE troubleshooting. At the very least, these devices will detect the presence of PoE and will tell you whether the power is coming from an endpoint or mid-span PSE. Be aware, however, that some cable testers simply detect “phantom power”—that is, DC voltage that is simply being dumped onto the line by a non-802.3af-compliant injector. This is primarily intended to avoid damaging the tester, and is not really very useful for troubleshooting. What you want is a tester that detects and diagnosis 802.3af and Cisco-compliant PoE.

If your Ethernet cable tester doesn’t test PoE, and many don’t, your simplest option is the PowerDsiine PoE tester, available for about twenty dollars plus shipping. This device plugs into an Ethernet cable and has two LEDs that light up, one in the presence of a midspan injector and the other in the presence of an endpoint (switch).

One limitation of this type of tester is that it simply detects the presence of power, but it doesn’t report the actual voltage present. A second limitation is that it validates the PSE, but not the PD. That is, if the PD was having a problem with its phantom power negotiation, causing the PSE to withdraw power, the PowerDsine tester wouldn’t reveal that problem, since the PD would be disconnected from the network at the time the tester was connected.

A more robust tester is made by ByteBrothers. Called the Power Panel, this tester shows the actual voltage that is currently present on the line, which pairs carry the voltage, and whether the PSE is endpoint or midspan. Additionally, the ByteBrothers tester has the ability to request Ethernet link from the switch. This is useful because some PoE switches will not provide power to a port that doesn’t have link.

The ByteBrothers tester comes in two versions: one that replaces the PD, and another that sits inline between the PD and the PSE. Of the two, we strongly recommend the inline version. This will allow you to monitor the actual negotiation that is happening between the PD and the PSE, thereby validating both the PD and the PSE, as opposed to simply replacing the PD with the tester, which only validates the PSE. This device is available for under $200.