Sizing PoE on a UniFi residential network

Three IEEE 802.3 amendments define the PoE classes relevant to UniFi gear. The shorthand names are common, but the watt numbers that matter are the delivered numbers — what reaches the device after cable loss — not the at-the-port maximums.

802.3af — “PoE”

IEEE 802.3af-2003, formally Data Terminal Equipment (DTE) Power Via Media Dependent Interface (MDI),⁷ is the original standard. Per-port maximum at the PSE is 15.4 W; delivered to the device after cable loss is roughly 12.95 W. Older cameras, basic indoor APs, and PoE-powered VoIP phones live here. Ubiquiti consistently labels 802.3af devices simply “PoE.”

802.3at — “PoE+”

IEEE 802.3at-2009, formally the Data Terminal Equipment (DTE) Power via the Media Dependent Interface (MDI) Enhancements amendment,⁸ raises the per-port maximum to 30 W; delivered is roughly 25.5 W. Most current UniFi indoor APs sit here. Ubiquiti calls this “PoE+.”

802.3bt — “PoE++”

IEEE 802.3bt-2018, formally Physical Layer and Management Parameters for Power over Ethernet over 4 pairs,⁹ defines two upper tiers. Type 3 supplies up to 60 W per port (≈51 W delivered). Type 4 supplies up to 90 W per port (≈71.3 W delivered). High-draw outdoor APs, small-cell radios, larger pan-tilt cameras, and the handful of integrated PoE-powered devices like the UniFi Flex itself live here. Ubiquiti calls this “PoE++.”

A switch port that advertises “PoE+” will negotiate down to standard PoE for a device that asks for it; an 802.3bt switch will negotiate down through both lower tiers. The reverse does not work. An 802.3at-only switch cannot supply 802.3bt — it does not have the 4-pair power-injection circuitry to do so — and the device will either refuse to power on or come up in a reduced-power mode that quietly disables features.

Switch datasheets list two numbers — a per-port maximum and a total PoE availability. The per-port number is useful only for confirming that any single device will fit. The total — the budget — is what governs how many devices can run concurrently.

A worked example with verified per-device draws and a verified switch budget. A UniFi Switch Lite 16 PoE ships with 8 PoE+ ports and a 45 W total PoE budget.¹ Three plausible residential loadouts:

• Two U7 Pro APs + one G5 Bullet camera. 2 × 21 W + 1 × 4 W = 46 W. Over budget by 1 W. In practice this loadout often appears to work — the switch under-delivers to one device, telemetry shows the device drawing slightly less than its label — but it sits at the edge of headroom and gives no margin for a firmware update that bumps draw.
• One U7 Pro + four G5 Bullets. 21 W + 4 × 4 W = 37 W. Under budget with margin.
• Two U7 Pro APs + four G5 Bullets + a doorbell + an intercom. Even with optimistic 4 W per camera, this is well above 45 W before the doorbell and intercom are counted. Not a budget the Lite 16 PoE was built for.

The same math at the next switch tier shifts the calculus dramatically. A UniFi Switch Lite 8 PoE advertises 52 W of PoE budget across 4 PoE+ ports;²the USW-Pro-24-PoE advertises 400 W across 16 PoE+ and 8 PoE++ ports;⁴ the USW-Pro-48-PoE advertises 600 W across 40 PoE+ and 8 PoE++ ports.⁵ The same shopping list that fails on the Lite 16 PoE sits comfortably inside the Pro-24-PoE budget.

Our planning rule is straightforward. Sum the maximum draws of every PoE device on the rack from current vendor specs. Add 20 percent margin for headroom and future devices. Choose the smallest switch whose total PoE availability exceeds that number. Do not size by port count.

Specs verified against the Ubiquiti techspecs pages for each model on the publication date of this article. Vendor specs change with revisions; always re-verify before ordering.

• USW-Lite-8-PoE— 4 PoE+ ports (out of 8 total), 52 W total PoE availability, per-port PoE+ 30 W max.²
• USW-Lite-16-PoE— 8 PoE+ ports (out of 16 total), 45 W total PoE availability, per-port PoE+ 32 W max.¹
• USW-Pro-24-PoE— 16 PoE+ and 8 PoE++ ports, 400 W total PoE availability, 30 W per PoE+ port and 64 W per PoE++ port.⁴
• USW-Pro-48-PoE— 40 PoE+ and 8 PoE++ ports, 600 W total PoE availability, 32 W per PoE+ port and 64 W per PoE++ port.⁵
• USW-Flex— small outdoor/indoor 5-port switch designed to be itself PoE-powered. Accepts a 60 W PoE++ input (46 W pass-through budget) or PoE+ input (20 W pass-through), or a dedicated 60 W adapter. Outputs PoE+ on four ports and PoE++ on one.¹⁰

A note on the Lite 16 PoE that surprises most first-time buyers. The model name suggests sixteen powered ports. Only eight are PoE-capable; the other eight are data only. And the 45 W aggregate is well under what a single Type 3 802.3bt device wants — there are no 802.3bt outputs on this switch at all. It is sized for a small AP-plus-doorbell deployment, not for a multi-camera install. When the camera count goes above two or three, the Pro-24-PoE is the next sensible step.

Verified against the techspecs page for each model. Where a class is given, that is the negotiated class the device requests from the switch.

• U7 Pro— PoE+ (802.3at), max 21 W.³
• U7 Pro Max— PoE+ (802.3at), max 25 W.¹¹
• U6 Enterprise— PoE+ (802.3at), max 22 W.¹²
• U6+ — PoE, max 9 W.¹³
• G5 Bullet — PoE, max 4 W.⁶
• G5 Flex — PoE, max 4 W.¹⁴

Two observations from this list. First, draws move between generations — the same model name with a different revision sometimes shifts a watt or two, and a firmware update can shift the steady-state by a similar margin. Treat the published spec as a ceiling, not as a contract. Second, the access points dominate the budget. Cameras and doorbells are usually under 5 W each; APs are 9 to 25 W each. A two-AP-plus-six-camera home is roughly 50 to 70 W of expected PoE draw before any growth margin. That is comfortably inside the Pro-24-PoE; it is well outside the Lite 16 PoE.

A PoE port does not blindly push 30 W down the cable when a device is plugged in. The IEEE 802.3 classification process is a two-step negotiation. The switch (the PSE, Power Sourcing Equipment) first applies a low-voltage detection signature; if it sees the right resistance on the link, it knows a powered device (a PD) is present and not, for example, a straight-through Ethernet cable into a non-PoE switch that would short out if power were applied.

Once detection succeeds, the PSE measures the classification current the PD pulls during a short pulse and assigns it a class — 0 through 4 for 802.3af/at, with additional fine-grained classes added under 802.3bt. The PSE then allocates that class's worth of budget. If the budget runs out before all ports are classified, later devices come up at a degraded class or stay off entirely.

Modern UniFi gear additionally exchanges LLDP-MED PoE power-via-MDI TLVs over the link once it is up. The PD tells the PSE the actual draw it would like to maintain (which is often well below the class maximum), and the PSE confirms what it can give. This is the layer where most real-world UniFi PoE complaints get resolved. When LLDP fails to converge — wrong power class advertised on one side, a firmware mismatch between generations, or a midspan injector that strips LLDP — the device gets stuck at the lower-class allocation and a 21 W AP comes up in some sort of degraded state.

The USW-Flex chain failure is the canonical case in the community. The USW-Flex is a switch that is itself powered over Ethernet. To output its full PoE budget, it needs to be receiving 802.3bt PoE++ on its uplink — otherwise it goes into a reduced budget. The community.ui.com thread “Saga of USW-Flex failing to negotiate 802.3bt using USW-Pro-24-PoE” documents a chain of cases where the negotiation fails even between two Ubiquiti devices that are both 802.3bt-capable on paper.¹⁵ The resolution is usually firmware-level — re-pair the PSE/PD, update both ends, occasionally manually pin the port to a class — and is a reminder that “both ends support PoE++” is not the same as “both ends will agree on PoE++ today.”

A PoE injector — a midspan device that sits between a non-PoE switch port and a PoE device — is the right answer for exactly one situation: there is a single PoE device, the switch in the rack has no spare PoE port at the right class, and pulling a new run to a budgeted switch is not feasible. Two injectors in the same rack are usually a sign that the wrong switch was bought.

Three failure modes worth naming because they recur:

• Class mismatch.A 24 V passive injector shipped with a generic IP camera will fry an 802.3at-required UniFi AP, and vice versa. Always buy the injector to match the device, never the “cheap universal” option.
• LLDP stripping.Some older injectors do not pass LLDP TLVs through. The PD sees the injector's static class advertisement and never negotiates upward. Devices that depend on LLDP-MED to request 25 W instead of 13 W end up in reduced-feature mode.
• Cable polarity.Mode A (endspan, power on the data pairs) and Mode B (midspan, power on the spare pairs) both exist in the standard. A passive injector that assumes the wrong pairs are unused — common in pre-802.3bt designs that did not anticipate 4-pair power — can damage gear that was designed for the other mode.

If a rack is collecting injectors, plan a switch replacement. It is almost always cheaper than the cumulative cost of injectors, their power bricks, and the on-call hours spent chasing intermittent failures.

The IEEE 802.3 channel limit is 100 metres end-to-end — 90 m of permanent cabling plus up to 10 m of patch cords. That is a data spec. It is not a guarantee that a PoE device at the far end receives its full advertised wattage.

Copper has resistance, and resistance drops voltage. The further the run, the more of the supplied power dissipates as heat in the cable instead of arriving at the device. The standard accounts for this — that is why the per-port maximum is 30 W at the PSE on 802.3at but only ≈25.5 W deliveredat the PD. The standard's assumed cable model is built around 24 AWG conductors at a 100 m channel length. Two consequences worth planning around:

• Long runs with thin conductors lose more power.A 95 m run of 24 AWG Cat 6 to a Type 3 802.3bt camera has noticeably less headroom than a 30 m run of the same cable. If the device is at the edge of its class — an AP drawing 24 W on a 25.5 W delivery budget — the long run can put it under.
• Thicker conductors give margin. 23 AWG Cat 6/6a cabling has roughly 20 percent less DC resistance per unit length than 24 AWG. For long runs to high-draw devices, the thicker gauge is the boring, durable answer.

In residential practice, we plan around the 100 m channel as a hard limit, use 23 AWG Cat 6a for any run we expect to deliver more than 25 W, and prefer to keep PoE++ runs under 75 m where the layout permits it. Voltage drop is not a hypothetical; it is the reason a perfectly good cable test passes and a heavy PoE device still misbehaves on the same run.

A PoE switch delivering hundreds of watts dissipates a meaningful fraction of that as heat in its own chassis. The Pro-24-PoE and Pro-48-PoE both ship with active fans for that reason. In a closed rack with no airflow, the switch will thermally throttle long before the PoE budget runs out — a different failure mode that presents identically to a budget problem in the controller.

Three placement rules we keep:

• Front-to-back airflow needs space. A switch buried in a closed AV cabinet with no vents will run hotter than its spec range, accelerating fan wear and shortening service life. A 1U or 2U gap above and below, plus a path to the room air, is the minimum.
• Network rack ≠ living space. The Pro-series PoE switches have fans that some homeowners find audible. A separate utility room, a closet, or a basement nook is the right home for the rack; the laundry room is fine; a bedroom is not.
• Cool, dry, accessible. Avoid attics (hot in summer), avoid garages with hot/cold extremes unless explicitly rated, avoid behind a fixed millwork wall that turns a service call into a carpentry job.

The Lite series has no active fans and can live more anywhere, including inside a closed cabinet. The Pro-series should never be put somewhere a fan blockage can go unnoticed for months.

• Specs occasionally change with revisions and firmware. The wattages here are the current Ubiquiti techspecs as of publication. A later hardware revision of the same model can shift one or two watts; a firmware update can shift the steady-state draw. Re-verify the spec for each device before sizing a switch.
• Classes get re-negotiated. Classification is not a one-time event at boot. A device whose LLDP TLV exchange fails after a reboot can drop a class for the remainder of its uptime. When a previously well-behaved device starts drawing less than expected, the LLDP layer is the first thing to check.
• Some non-Ubiquiti PoE devices fib about their class. Generic cameras, generic doorbells, and budget VoIP phones often advertise one class and pull power as if they belong in a higher one. The result is a switch whose advertised budget is correct on paper and short in practice. When mixing third-party devices on a UniFi switch, monitor the actual draw per port in the controller rather than trusting the labels.
• Older equipment cannot negotiate upward. An 802.3af-only camera or AP cannot accept 802.3at or 802.3bt power, even on a switch that supplies it. The switch correctly negotiates down. This is not a fault; it is how the standard is supposed to work.
• The aggregate budget is a budget, not a cap.If a switch's 45 W is oversubscribed, the controller will issue a warning, but the way the over-allocation expresses itself in the field is device-dependent. Some devices fall back to a degraded mode; some refuse to power on; some cycle. The right place to fix it is in the budget math, not at the device.
• UniFi is not the only PoE world. The IEEE standards apply across vendors; the per-device draws and switch budgets here are Ubiquiti-specific only because that is the lineup this article scopes. The planning method — sum the draws, add a margin, choose the budget — is the same for any vendor.

None of these caveats changes the underlying rule. The total PoE budget is the number that matters; per-port maximums are confirmation, not capacity. Add up the shopping list before the switch is ordered, leave margin, and the network does what it was designed to do.