PoE Cameras and Network Design: One Cable to Rule Them All

Power over Ethernet (PoE) allows a network switch to deliver DC power alongside data over a standard Cat5e or Cat6 Ethernet cable. For IP cameras, this means a single cable run from the switch or patch panel to the camera provides everything the device needs: network connectivity and electrical power. The result is faster installation, lower cabling cost, and simpler ongoing management.

The two PoE standards you will encounter most often are IEEE 802.3af (PoE), which supplies up to 15.4 W per port, and IEEE 802.3at (PoE+), which supplies up to 30 W. Most fixed IP cameras draw between 7 W and 15 W, so standard PoE (802.3af) is sufficient. PTZ cameras with heaters or high-power IR illuminators may require PoE+ or even IEEE 802.3bt (PoE++) at up to 60 W or 90 W per port.

When selecting a PoE switch for cameras, two numbers matter: the number of PoE ports and the total PoE power budget. A 24-port PoE+ switch might list 370 W of total PoE power. If each camera draws 15 W, you can power 24 cameras (24 × 15 = 360 W), which just fits. If some cameras are PTZ units drawing 30 W, you need to recalculate. Always leave a 10–20% margin on the PoE budget to allow for peak draw and future expansion.

For larger deployments, consider using a combination of a core switch and edge PoE switches. Place edge switches in distribution cabinets close to camera clusters (e.g., one per floor or one per building) and connect them back to the core switch via fibre uplinks. This keeps cable runs within Ethernet's 100-metre limit and reduces the total length of copper cabling.

Surveillance cameras should sit on their own VLAN (Virtual LAN), separate from corporate data, voice, and guest traffic. This provides three benefits:

• Security: Cameras cannot be accessed or attacked from the general network, and a compromised camera cannot pivot into business systems.
• Performance: Camera traffic — which is constant and bandwidth-heavy — does not compete with user traffic on the same broadcast domain.
• Management: Network administrators can apply QoS policies, firewall rules, and monitoring specifically to the camera VLAN.

Each camera generates a continuous stream of data. A 4MP camera at 15 fps using H.265 produces roughly 4–6 Mbps. On a Gigabit uplink, you can aggregate about 150–200 cameras before reaching practical throughput limits (accounting for overhead and bursts). However, the uplink from an edge switch to the core is often the bottleneck. A 24-port edge switch with 24 cameras at 5 Mbps each generates 120 Mbps of upstream traffic — well within a single Gigabit uplink, but you should still monitor utilisation and plan for growth.

If you are recording to a remote NVR or server across the network, the traffic traverses the backbone twice: once from camera to switch, and once from switch to recorder. Plan your trunk links accordingly. For deployments exceeding 100 cameras on a single recorder, consider 10 Gbps uplinks between distribution switches and the recording server.

Standard Ethernet (Cat5e, Cat6, Cat6A) supports a maximum cable run of 100 metres from switch to device, including patch leads at both ends. Beyond this distance, both data integrity and PoE voltage drop become unreliable. To reach cameras further away, you have several options:

• PoE extenders: Inline devices that regenerate both data and power, adding another 100 m per extender. Some models can be daisy-chained.
• Fibre-to-Ethernet media converters: Run single-mode or multi-mode fibre to a remote location, then convert to Ethernet for the final copper run. Fibre supports distances of hundreds of metres to several kilometres.
• Remote PoE switches: Compact outdoor-rated switches placed near camera clusters, fed by fibre from the main comms room.

Outdoor camera installations introduce additional challenges. Cameras need an IP66 or IP67 weatherproof rating to withstand rain, dust, and temperature extremes. Cable entry points must be sealed with weatherproof glands or junction boxes. Surge protection is critical on any cable that runs outdoors or between buildings — a lightning strike nearby can induce a voltage spike that destroys both the camera and the PoE switch port. Install Ethernet surge protectors at both ends of outdoor cable runs.

Grounding is equally important. The surge protector must be bonded to a proper earth connection to divert transient energy safely. Without effective grounding, a surge protector is little more than a pass-through connector.

Beyond VLANs, consider these additional segmentation practices for a robust surveillance network:

• Disable unused switch ports to prevent unauthorised devices from being plugged into the camera network.
• Use 802.1X port authentication if your cameras and switches support it, so only authorised devices can connect.
• Apply access control lists (ACLs) to restrict camera traffic to the NVR/VMS subnet — cameras should not be able to reach the internet or corporate servers.
• Monitor the camera VLAN for unusual traffic patterns that could indicate a compromised device.
• Use a dedicated management VLAN for switch administration, separate from both camera and user VLANs.