What Is PoE++ and Why Does It Matter for Network Design?

Power over Ethernet (PoE) lets a network cable carry both data and electrical power. It can simplify installations by reducing the need for separate power outlets near every device. But as cameras, wireless access points and other endpoints become more capable, their power demands increase. That is where PoE++ devices and the switches that support them enter the design conversation.

PoE++ is commonly used to describe the higher-power capabilities of the IEEE 802.3bt standard. It can support equipment that earlier PoE standards cannot reliably power. That creates useful options for network designers, but it also makes power budget planning, cabling, switching and security design more important.

In my experience, the network problems that become security incidents rarely begin with a dramatic exploit. Sometimes they start with an overloaded switch, an unlabelled patch panel or a mystery cable that nobody can account for. Physical infrastructure is not separate from cybersecurity. It is one of its foundations.

What Is PoE++?

PoE++ is a widely used, informal name for power delivered over four pairs of conductors in an Ethernet cable under IEEE 802.3bt. It includes two power levels, often called Type 3 and Type 4. Earlier PoE standards generally provide less power and use two pairs. The additional capacity makes PoE++ suitable for devices with higher or more variable power requirements.

PoE category Typical maximum power from the switch What to know IEEE 802.3af (PoE) 15.4 W per port Common for basic phones and access points. IEEE 802.3at (PoE+) 30 W per port Supports a broader range of access points and cameras. IEEE 802.3bt Type 3 (often called PoE++) Up to 60 W per port Uses all four cable pairs and supports higher-power endpoints. IEEE 802.3bt Type 4 (often called PoE++) Up to 90 W per port Provides the highest standardised PoE power level.

These figures describe power supplied by the power sourcing equipment (PSE), usually a switch. The amount available at the powered device (PD) is lower because some energy is lost in the cable. The exact allowance depends on the standard, the link and the equipment. Check the switch and device specifications rather than treating a product’s “PoE++” label as a complete power guarantee.

What Can PoE++ Devices Power?

PoE++ can make it practical to install devices where a separate electrical supply would be difficult, costly or disruptive. Examples include:

• High-performance wireless access points with multiple radios or advanced features.
• PTZ and multi-sensor cameras, including models with heaters or other accessories.
• Video conferencing equipment and digital signage.
• Building automation and industrial devices designed for Ethernet power.
• Some compact workstations, lighting systems and access-control equipment.

The device’s maximum draw is not always its normal draw. A camera may use more power when zero trust architecture vs perimeter its heater or infrared illumination is active; an access point may draw differently as radios and client load change. Design for the device’s specified requirements and operating conditions, not just its typical consumption.

Power Budget Planning: The Switch Is More Than a Port Count

A switch can have enough physical ports for every endpoint and still be unable to power them all at once. Its total PoE budget is the amount of power it can provide across those ports, which may be considerably less than the sum of every port’s maximum rating.

For example, a 48-port switch might advertise PoE++ on selected ports but have a total power budget that cannot support 48 high-draw devices simultaneously. The switch may prioritise ports, deny power to a newly connected device or reduce available capacity, depending on its design and configuration. That behaviour needs to be understood before an outage exposes it.

A practical planning checklist

1. Inventory endpoints. Record the model, standard, maximum power draw, location and criticality of each planned device.
2. Check the PSE capability. Confirm per-port support and the switch’s total PoE budget. “PoE++ switch” does not necessarily mean every port can supply the maximum Type 4 level.
3. Calculate simultaneous demand. Allow for devices drawing more power at peak operation, not only the average load.
4. Include headroom. Leave capacity for growth, device changes and unexpected operating conditions. Avoid designing a critical switch to sit at its limit.
5. Review power resilience. Check switch power supplies, UPS runtime and what happens if a power supply or switch fails.
6. Confirm the cabling path. Account for cable length, quality, patch panels, connectors and the installation environment.
7. Test and document. Validate actual device behaviour and record which ports serve which endpoints.

Also consider how the switch allocates power. Some platforms reserve the maximum configured allowance per port; others can allocate based on negotiation or measured use. This affects how many devices can be supported and what happens when another device is connected. Keep a safety margin, and test the failure case: what happens at 2am when a switch reboots and several high-power endpoints try to start together?

Cabling and Switching Are Part of the Security Design

PoE++ is not just a procurement choice. Higher power over copper makes installation quality and cable management more consequential. Use cabling and components appropriate to the required Ethernet performance, installation conditions and applicable standards. Poor terminations, damaged cable, unsuitable patching or excessive heat can cause intermittent faults, degraded links and unexpected device resets.

Those faults have security consequences as well as operational ones. If a camera repeatedly drops offline, the site may lose coverage. If an access point flaps, users may fall back to less controlled connectivity or create workarounds. If a switch is replaced in a hurry and its configuration is not restored correctly, intended network separation can disappear. A physical-layer fault can therefore create both an outage and a security blind spot.

Keep patch panels and switch ports clearly labelled. Document cable routes and endpoint locations. Remove abandoned connections rather than leaving mystery cables in place. In production environments, avoid unmanaged switches: they can hide device connections, undermine visibility and prevent reliable enforcement of network policy.

PoE++, Segmentation and Cybersecurity

Segmentation depends on capable switching and correct design. A network carrying cameras, corporate laptops, building systems and industrial equipment should not rely on one flat broadcast domain. Separate networks or VLANs, access controls and firewall policies can limit unnecessary communication and reduce the impact of a compromised endpoint.

PoE does not provide segmentation by itself. A powered device is still a network endpoint, and its traffic needs to be placed, monitored and controlled appropriately. Design decisions should cover the complete path: the switch port, VLAN assignment, routing and firewall rules, management plane, and the services the device is allowed to reach.

For example, a camera may need to communicate with a recording system and approved management services, but not with user workstations. An industrial sensor may need a narrowly defined path to a control platform, not unrestricted access to corporate applications. Apply least privilege, use secure management protocols and protect switch administration with strong authentication and suitable management-network controls.

Firewalls help enforce policy between network zones, while endpoint detection platforms can provide visibility or alerting for supported endpoints. Neither can compensate for an unknown cable, a misconfigured access port or an unmanaged switch sitting between the endpoint and the controls. Physical and logical safeguards have to work together.

The Australian Cyber Security Centre (ACSC) publishes guidance that organisations can use to improve cyber security. Putting that guidance into practice depends on solid network foundations: accurate asset information, secure configurations, controlled access and effective separation of systems. Segmentation is harder to verify and maintain when the physical network is undocumented or switching capabilities are inadequate.

Choosing Switches and Planning for the Real Environment

When comparing PoE switches, look beyond the number of ports and the headline power figure. Check the supported IEEE standard, per-port limits, total PoE budget, power-supply options and behaviour when the budget is exhausted. For managed switches, review VLAN, access-control, monitoring and logging capabilities alongside lifecycle support and configuration management.

Vendors such as Cisco offer switching platforms that may suit enterprise requirements, depending on the model and design. For industrial environments, MOXA provides networking equipment intended for demanding operational settings; suitability still depends on the specific device, environmental conditions and required certifications. Garland Technology is known for network visibility products such as network TAPs, which can help provide an observation point for monitoring traffic. These products serve different roles, so assess each against the architecture rather than treating brand names as a substitute for a design.

Where network visibility matters, decide how monitoring tools will receive traffic and whether the chosen switch or a separate visibility solution supports that requirement. A network TAP can provide a copy of traffic for analysis, but it does not replace access controls, segmentation or endpoint monitoring. Verify how tools fit together before deployment.

Design for Failure, Not Just Installation Day

High-power PoE can reduce the need for local power outlets and simplify changes, but centralising power in switches also concentrates risk. If a switch loses power, its connected endpoints may go down together. For critical cameras, wireless coverage or operational equipment, consider switch placement, UPS capacity, redundancy, spare capacity and recovery procedures.

Document what is powered by each switch and what business function depends on it. Test a realistic failure scenario: a switch restart, a failed power supply, an overloaded PoE budget or loss of the uplink. Confirm that alarms reach the people who can act on them. Incident response is much easier when the team knows which switch powers a critical camera and where its cable runs.

Conclusion

PoE++ extends Ethernet power to devices that need more than earlier PoE standards can provide. It can simplify deployments, but it also demands careful power budget planning, suitable cabling and switches, and a clear approach to resilience.

Most importantly, treat the physical network as part of the security architecture. Reliable cabling, managed switching, documented ports and deliberate segmentation help prevent faults from becoming outages—or blind spots. Before approving a PoE++ design, ask not only whether it works on day one, but what happens at 2am when it fails.