PoE-Out

PoE-Out

Summary

The PoE-Out feature enables MikroTik devices to provide power to connected network devices through the Ethernet cable, eliminating the need for separate power supplies for powered devices (PDs). This capability is available on MikroTik devices equipped with at least one PoE-Out interface and allows for simplified deployments where devices such as access points, IP cameras, and VoIP phones can receive both power and network connectivity through a single cable.

MikroTik devices utilize the RJ45 Mode B pinout for power delivery, with PoE supplied through pins 4 and 5 for positive (+) and pins 7 and 8 for negative (-). When powering other devices via PoE-Out, it is recommended to use a minimum input voltage of 18V, unless the device supports multiple output voltages. Devices like the CRS112-8P-4S-IN, CRS328-24P-4S+RM, and CRS354-48P-4S+2Q+RM support switchable voltage modes that provide flexibility in powering various PDs.

The PoE-Out system includes comprehensive safety features such as overload protection, short-circuit detection, and compatibility detection to prevent damage to both the power sourcing equipment (PSE) and powered devices. Each PoE-Out implementation supports these protective measures regardless of the selected PoE-Out mode, ensuring reliable and safe operation in various network environments.

Supported PoE Standards

MikroTik devices support different PoE standards depending on the model, ranging from passive PoE to the latest IEEE 802.3bt standard. Understanding these standards is essential for selecting compatible devices and ensuring proper power delivery to your network equipment.

Passive PoE-Out Up to 30V

Passive PoE-Out up to 30V is a non-negotiated power delivery method that does not require communication between the PSE and PD. The PoE-Out voltage matches the input voltage supplied to the PSE, making it straightforward to deploy but requiring careful voltage matching between the power source and connected devices. This standard is suitable for devices that accept lower voltages and do not require sophisticated power negotiation protocols. Devices supporting this standard include the hEX PoE lite (RB750UPr2), RB3011UiAS-RM, and RB2011iL-IN. The passive approach provides simplicity but lacks the intelligent power negotiation features of IEEE standards, which means voltage and current must be carefully matched to avoid damaging connected devices.

Passive PoE-Out Up to 57V

Passive PoE-Out up to 57V operates similarly to the lower voltage passive PoE but extends the voltage range to support devices requiring higher input voltages. This standard can power both standard passive PoE devices and af/at compatible devices that accept power over the Mode B pinout without requiring PoE negotiation. The higher voltage capability allows for more flexible power source options and supports devices with varying power requirements. Models supporting this extended voltage range include the cAP ac, hAP ac (RB962UiGS-5HacT2HnT), and wsAP ac lite. The increased voltage range also enables better power delivery over longer cable runs by reducing current requirements for the same power output, minimizing voltage drop along the cable length.

IEEE 802.3af/at (PoE+)

The IEEE 802.3af (PoE Type 1) and 802.3at (PoE+ Type 2) standards define a negotiation mechanism between PSE and PD to ensure compatible power delivery. These IEEE standards establish voltage ranges between 44V and 57V and provide up to 25.5W at the PD for at-compliant devices. MikroTik PSEs supporting these standards can power both Type 1 and Type 2 PDs, providing backward compatibility with older 802.3af devices while supporting higher-power 802.3at devices. This standard also enables intelligent power management, allowing the PSE to determine the power requirements of connected devices before applying power, reducing the risk of damage from incorrect voltage or current. Devices supporting af/at include the CRS112-8P-4S-IN, CRS328-24P-4S+RM, and CRS354-48P-4S+2Q+RM. The IEEE standards also ensure multi-vendor compatibility, allowing devices from different manufacturers to work together reliably.

IEEE 802.3bt (PoE++)

The 802.3bt standard, also known as PoE++, significantly extends power delivery capabilities by using all four pairs of wires in Gigabit Ethernet cables for power transmission. This “4-pair Power over Ethernet” approach enables power delivery up to 90W at the PD for Type 4 (Class 7-8) devices, supporting high-power applications such as wireless access points with multiple radios, PTZ cameras with heating elements, and digital signage displays. The standard introduces Type 3 (Classes 5-6) for up to 51W and Type 4 (Classes 7-8) for up to 90W power delivery. Critically, 802.3bt powering is isolated from the device powering itself, ensuring that high-power PDs do not impact the PSE’s own power requirements. The CRS320-8P-8B-4S+RM is an example of a MikroTik device supporting 802.3bt, providing 560W for af/at devices and up to 1667W for bt devices across its 16 PoE-Out ports.

PoE-Out Capable Devices

Selecting the appropriate PoE-Out device requires understanding the power requirements of your connected devices and the total power budget available. The following table compares key specifications across MikroTik’s PoE-Out capable product line to aid in device selection.

Device	PoE-Out Ports	Passive PoE	802.3af/at	802.3bt	Power Input	Max Output/Port	Max Total Output
CSS610-8P-2S+IN	8	Yes	Yes	No	AC & DC 48-57V	1000mA	625W
CRS328-24P-4S+RM	24	Yes	Yes	No	AC	1000mA	450W
CRS354-48P-4S+2Q+RM	48	Yes	Yes	No	AC	1000mA	700W
CRS112-8P-4S-IN	8	Yes	Yes	No	DC 18-30V & 30-57V	1000mA	450W
netPower 16P	16	Yes	Yes	No	DC 18-30V & 30-57V	1100mA	600W
RB5009UPr+S+	8	Yes	Yes	No	DC 18-30V or 30-57V	900mA	440W
hEX PoE	4	Yes	Yes	No	DC 18-30V or 30-57V	1000mA	450W
PowerBox Pro	4	Yes	Yes	No	DC 18-30V or 30-57V	1000mA	450W
OmniTIK 5 PoE ac	4	Yes	Yes	No	DC 18-30V or 30-57V	1000mA	450W
hEX PoE lite	4	Yes	No	No	DC 18-30V	1000mA	60W
PowerBox	4	Yes	No	No	DC 18-30V	1000mA	60W
RB260GSP	4	Yes	No	No	DC 18-30V	1000mA	60W
OmniTIK 5 PoE	4	Yes	No	No	DC 18-30V	1000mA	60W
CRS320-8P-8B-4S+RM	16	Yes	Yes	Yes	AC	-	963W

The CSS610-8P-2S+IN provides an affordable entry point for small deployments requiring up to 8 PoE-Out ports with IEEE standard support. The CRS328-24P-4S+RM and CRS354-48P-4S+2Q+RM offer high port counts suitable for larger installations, with the CRS354 providing up to 700W total power budget across 48 ports. For deployments requiring 802.3bt support, the CRS320-8P-8B-4S+RM delivers exceptional power capacity with 560W for af/at devices and 1667W for bt devices, making it suitable for high-power applications like Wi-Fi 6E access points and advanced surveillance systems.

Configuration

PoE-Out configuration is available through RouterOS via the CLI, Winbox, and WebFig interfaces. The configuration is organized under the /interface ethernet poe menu hierarchy, with global settings under /interface ethernet poe settings and per-port configuration under /interface ethernet poe.

Basic Commands

The following commands provide essential PoE-Out management operations for monitoring and basic configuration tasks.

/interface ethernet poe
print
export
monitor [find]
power-cycle duration=5s

The print command displays current PoE-Out settings for all ports, showing the configured mode, priority, and status. The export command shows the complete configuration that can be used for backup or replication on similar devices. The monitor command with the [find] argument displays real-time PoE-Out status for all ports, including voltage, current, and power readings. The power-cycle command temporarily disables power on a specified port for a configurable duration, useful for rebooting unresponsive connected devices without physical access.

Global Settings

Global PoE settings apply to all PoE-Out ports on devices that support this feature and are configured under /interface ethernet poe settings.

/interface ethernet poe settings
set ether1-poe-in-long-cable=yes
set psu1-max-power=96
set routerboard-max-self-power=30
set poe-out-limit-power=400
set psu1-poe-out-max-power=350

The ether1-poe-in-long-cable setting disables short-circuit detection on all PoE-Out ports when set to yes, allowing PoE-Out operation with long Ethernet cables or preventing false short-circuit detection in challenging cable environments. This setting should be used with caution as it reduces the protective features of the PoE-Out system. The psuX-max-power parameter specifies the maximum power that the power supply unit can draw, which is particularly important for the RB5009UPr+S+IN that supports multiple PSU inputs. The routerboard-max-self-power setting reserves power for the device’s own operation, ensuring that PoE-Out budget calculations account for the router’s internal power consumption. The poe-out-limit-power parameter sets a global PoE-Out budget limit, allowing administrators to constrain power delivery even when the hardware supports higher output.

Port Settings

Individual PoE-Out ports can be configured independently to control power delivery behavior and priority settings.

/interface ethernet poe
set ether1 poe-out=auto-on poe-priority=10 poe-voltage=auto poe-lldp-enabled=no
set ether2 poe-out=forced-on poe-priority=5
set ether3 poe-out=forced-on-a
set ether4 poe-out=off

The poe-out parameter controls the power delivery mode for each port. The auto-on mode enables intelligent detection, applying power only when a compatible PD with resistance between 3kΩ and 26.5kΩ is detected. The forced-on mode bypasses detection and applies power continuously, suitable for non-standard devices that may not present the expected resistance signature. The forced-on-a mode delivers power through the A (main) pairs instead of the B pairs, available only on PSE devices supporting 802.3bt. The forced-on-bt mode utilizes all four power pairs for maximum power delivery, also limited to 802.3bt-capable devices. The off mode disables all PoE-Out functionality on the port, reverting it to standard Ethernet operation.

The poe-priority parameter ranges from 0 (highest priority) to 99 (lowest priority) and determines which ports lose power first when the total PoE budget is exceeded. Ports with equal priority are ranked by port number, with lower-numbered ports receiving higher priority. The system checks every 6 seconds for the ability to restore power to ports that were disabled due to priority-based power cycling.

The poe-voltage parameter allows manual switching between low and high voltage outputs on devices with switchable voltage modes, including the CRS112-8P-4S-IN, CRS328-24P-4S+RM, netPower 16P, and CRS354-48P-4S+2Q+RM. The poe-lldp-enabled parameter enables Link Layer Discovery Protocol negotiation for power, allowing compatible PDs to request specific power levels. This feature was replaced by the Neighbor Discovery lldp-poe-power property starting from RouterOS version 7.15.

Power-Cycle Ping

The power-cycle-ping feature provides automatic monitoring and recovery for connected PDs by sending ICMP or MAC-Telnet ping requests and power-cycling ports when devices become unresponsive.

/interface ethernet poe
set ether1 power-cycle-ping-enabled=yes power-cycle-ping-address=192.168.88.10 power-cycle-ping-timeout=30s
set ether2 power-cycle-ping-enabled=yes power-cycle-ping-address=192.168.88.20 power-cycle-ping-timeout=1m

When power-cycle-ping-enabled is set to yes, the PSE continuously monitors the specified address using ICMP ping requests. If the PD does not respond within the power-cycle-ping-timeout period, the PoE-Out port is disabled for 5 seconds before power is restored. This automatic recovery mechanism is valuable for remote deployments where physical access to rebooting connected devices is impractical. MAC addresses can be used instead of IP addresses for monitoring, which triggers MAC-Telnet ping requests sent from the specified Ethernet interface. When using VLAN filtering or complex VLAN switching configurations, IP address monitoring is recommended to ensure proper route resolution to the PD.

Monitoring

PoE-Out status monitoring provides visibility into the operational state and power delivery parameters for each port, enabling administrators to verify proper operation and diagnose connectivity issues.

Real-Time Monitoring

The monitor command displays current PoE-Out status, voltage, current, and power readings for specified ports.

/interface ethernet poe monitor ether1

The output displays the following key metrics: poe-out shows the configured mode, poe-out-status indicates the current operational state, poe-out-voltage displays the voltage being delivered to the PD, poe-out-current shows the current draw in milliamperes, poe-out-power indicates power consumption in watts, and poe-out-power-pair shows which power pairs are being used (a for pairs 1,2/3,6; b for pairs 4,5/7,8; bt for all four pairs).

PoE-Out Status States

The poe-out-status field can report several states indicating the current condition of each PoE-Out port.

The powered-on state indicates normal operation with power successfully being delivered to the connected PD. The waiting-for-load state means the PSE is in detection mode, attempting to identify a compatible PD with the expected resistance range. The short-circuit state indicates a short circuit has been detected, triggering automatic power disconnection; this can also indicate that the connected device does not support PoE. The overload state means the current draw exceeds the port’s limit, and power has been automatically disconnected to protect the PSE. The voltage-too-low state indicates the PSE voltage is insufficient for the connected PD’s requirements, while voltage-too-high suggests the PSE output exceeds the PD’s supported voltage range. The current-too-low state indicates the PD is drawing less than 10mA, which may indicate a compatibility issue or disconnected device. The voltage_on_poe-in state indicates unexpected voltage on the PoE-Out port, which could result from an external power source or internal circuitry fault. The off state indicates PoE-Out is disabled on the port. The power_reset state shows the PSE controller is resetting power, which occurs during power-cycle commands or ping-triggered reboots. The controller_init and controller_upgrade states indicate controller initialization or firmware update processes. The controller_error state indicates the PSE controller is not responding and may require attention.

SNMP Monitoring

SNMP protocol support enables integration with network monitoring systems for centralized PoE-Out status tracking.

/tool snmp-walk address=10.155.149.252 oid=1.3.6.1.4.1.14988.1.1.15.1.1.5
/tool snmp-get address=10.155.149.252 oid=1.3.6.1.4.1.14988.1.1.15.1.1.5.3

The SNMP OID table 1.3.6.1.4.1.14988.1.1.15.1.1 provides interface identification, names, voltage in decivolt (dV), current in milliamperes, and power in deciwatts (dW). The snmp-walk command retrieves all values from the table, while snmp-get with the specific OID extension retrieves the value for a particular port (the final number in the OID indicates the port index).

Logging

PoE-Out events are logged by default using “warning” and “info” topics, providing audit trails of state changes and troubleshooting information.

/system logging
set [find topics~"info"] topics=info,!poe-out
set [find topics~"warning"] topics=warning,!poe-out

The first log entry shows informative events such as power state transitions, while the second captures warnings about power issues. To disable PoE-Out logging, add !poe-out to the topic filter as shown in the example commands. When LLDP power negotiation is enabled, detailed LLDP status updates appear in the logs, including power request denials with reasons such as budget exceeded, hardware limit reached, low voltage port, port disabled, class limit exceeded, or controller communication failure.

Priority-Based Power Management

RouterOS allows definition of priorities on PoE-Out ports to manage power allocation when the total budget is exceeded, ensuring critical devices remain powered while lower-priority devices are shed first.

/interface ethernet poe
set ether2 poe-priority=10
set ether3 poe-priority=13
set ether4 poe-priority=11
set ether5 poe-priority=14

In this example, if the total PoE budget is exceeded, ether5 (priority 14) loses power first, followed by ether3 (priority 13) if the overload persists. The system rechecks every 6 seconds and restores power to disabled ports in reverse order when power becomes available. Ports with identical priority levels are ranked by port number, with lower-numbered ports receiving preference.

Troubleshooting

When PDs fail to power up or exhibit unexpected behavior when powered from a PSE, systematic troubleshooting helps identify and resolve the underlying issues.

PD Compatibility Verification

Verify that the PD’s supported input voltage matches the PSE output voltage range, as voltage mismatches prevent proper powering. Confirm the PD supports the PSE’s PoE standard (passive, af/at, or bt) even if it accepts the correct voltage range. Check whether the PD requires specific polarity configurations, as MikroTik devices use Mode B pinout (pins 4,5 positive; pins 7,8 negative). Ensure the PD resistance falls within the expected range: 3kΩ to 26.5kΩ for passive PoE and 23.75kΩ to 26.25kΩ for af/at standards.

Power Budget Assessment

Calculate the total power supply requirements by adding the PSE’s maximum power consumption, the maximum power consumption of all connected PDs, and a 10% safety margin. Verify the power supply unit (PSU) provides adequate output for the calculated requirements. Check the PSE datasheet for both per-port current limits (which differ between low voltage and high voltage modes) and total PoE-Out current limitations that may restrict simultaneous operation of all ports at maximum output.

Cable Quality Considerations

Poor-quality Ethernet cables can cause voltage drop, particularly over longer runs or when delivering higher power levels. Ensure cables meet Cat5e or higher specifications for PoE deployments, especially for high-power 802.3bt applications. Cable length should be kept within specifications, as excessive length increases resistance and voltage drop, potentially preventing PDs from receiving adequate voltage.

RouterOS Version

Outdated RouterOS versions may lack recent PoE-related features or contain bugs affecting PoE-Out operation. Verify you are running a current RouterOS version by checking the MikroTik download page for the latest stable release addressing known issues.

Safety Features

The PoE-Out system incorporates multiple protective mechanisms to ensure safe operation and prevent damage to connected equipment.

Compatibility Detection

The auto-on mode performs resistance detection on connected ports before applying power, verifying the resistance falls within the 3kΩ to 26.5kΩ range before enabling power delivery. This detection prevents power application to incompatible devices that might be damaged by incorrect voltage or current levels.

Overload Protection

When a PoE-Out port is powered, the PSE continuously monitors current draw against the port’s overload limit. If the limit is exceeded, power is automatically disconnected to protect both the PSE and PD. After approximately 6 seconds, the PSE attempts to restore power to check if conditions have changed, which is particularly important for solar or battery-powered installations where voltage fluctuations can trigger temporary overload conditions.

Short-Circuit Detection

The PSE continuously monitors for short circuits while power is enabled on PoE-Out ports. When a short circuit is detected, power is immediately disconnected on all ports to prevent damage. The PSE continues monitoring affected ports until the fault condition is cleared, at which point normal operation resumes automatically.

LED Indicators

PoE-Out status is indicated through LED indicators on devices, with behavior varying by model.

Devices with dependent voltage output display red LED when PoE-Out is powered-on and blinking red for short-circuit conditions. Models with selectable voltage output use green triangle LED for low voltage powered-on state and red triangle LED for high voltage powered-on state, with corresponding green or red blinking for short-circuit or overload conditions. The CRS112-8P-4S-IN and netPower 16P flash all PoE LEDs when an incorrect voltage PSU is plugged into one of the ports. The CRS320-8P-8B-4S+RM displays purple LED for powered-on 802.3bt (high voltage) state and blinking purple for short-circuit or overload conditions.

Abbreviations

• ACL: Access Control List
• af: IEEE 802.3af (PoE, up to 15.4W)
• at: IEEE 802.3at (PoE+, up to 25.5W)
• bt: IEEE 802.3bt (PoE++, up to 90W)
• CLI: Command Line Interface
• DC: Direct Current
• FDB: Forwarding Database
• ICMP: Internet Control Message Protocol
• IEEE: Institute of Electrical and Electronics Engineers
• LLDP: Link Layer Discovery Protocol
• PD: Powered Device
• PoE: Power over Ethernet
• PSE: Power Sourcing Equipment
• PSU: Power Supply Unit
• PTZ: Pan-Tilt-Zoom
• QoS: Quality of Service
• RJ45: Registered Jack 45 (network connector)
• SNMP: Simple Network Management Protocol
• VLAN: Virtual Local Area Network
• VoIP: Voice over Internet Protocol

See Also

• Neighbor Discovery
• SNMP
• Interface Configuration
• Bridge Hardware Offloading
• CRS1xx/2xx Series Switch Chip Features
• CRS3xx, CRS5xx, CCR2116, CCR2216 Switch Chip Features