Which PoE switch should you buy for access points and security cameras? Pick it by watts first and ports second. The shared PoE budget has to cover every camera and AP at its maximum draw plus about 25 percent. An access point with a 2.5GbE uplink also needs a 2.5GbE port, or it quietly runs at gigabit. The “8-port” on the box tells you neither, because plenty of 8-port PoE switches power only four ports.
We run PoE cameras feeding a Frigate NVR plus ceiling APs in the homelab, and the trade-offs below come from living with them. You get the budget math for any mix of cameras and Wi-Fi 7 APs, then seven switches from a 5-port desktop box to a 16-port rack unit. I went back through every spec sheet and Amazon listing in October 2026, and the prices are what the listings showed that week.
Size the switch for your cameras and APs
The sizing takes four steps, and the device numbers come from the draw table further down or from your own datasheets. Use the maximum draw, not what a meter shows at noon. Every camera switches on its infrared at the same moment when the light goes.
- Add up the maximum draw of everything you will plug in: cameras, access points, IP phones.
- Multiply the total by 1.25 to keep a 25 percent reserve.
- Pick a switch whose PoE budget beats that number and whose powered port count covers every device.
- Give any Wi-Fi 6E or Wi-Fi 7 AP with a 2.5GbE uplink a 2.5GbE port, and give anything that lists 802.3bt a PoE++ port.
Here it is worked through for the setups we get asked about most. A standard camera counts as 10W, a PTZ as 24W, a UniFi U6 Lite as 12W and a UniFi U7 Pro as 21W:
| Your setup | Peak draw | With 25% reserve | Smallest pick that covers it |
|---|---|---|---|
| 3 cameras + 1 Wi-Fi 6 AP | 42W | 52.5W | TP-Link TL-SG1005P (65W, 4 powered ports) |
| 2 cameras + 2 Wi-Fi 7 APs on 2.5GbE, no VLANs | 62W | 77.5W | Zyxel XMG-108HP (100W, 2.5GbE) |
| 6 cameras + 1 Wi-Fi 6 AP, gigabit is fine | 72W | 90W | TP-Link TL-SG1008MP (126W or more) |
| 4 cameras + 2 Wi-Fi 7 APs on 2.5GbE, camera VLAN | 82W | 102.5W | TP-Link Omada SG3210XHP-M2 (240W, managed) |
| 2 PTZ + 4 cameras + 2 Wi-Fi 7 APs | 130W | 162.5W | TP-Link Omada SG3210XHP-M2 (all 8 ports used) |
| 12 cameras + 2 Wi-Fi 6 APs | 144W | 180W | TP-Link TL-SG1218MP (250W) or the fanless NETGEAR GS316PP (183W) |
| Any AP or PTZ that lists 802.3bt | 51W (Type 3) or 71.3W (Type 4) per device | 63.75W or 89.1W per device, plus the rest of the mix | MokerLink POE-10G07110GSM (90W per port, 260W) |
Two rows in that table are closer than they look. The 4-camera, 2-AP setup needs 102.5W, just past the 100W Zyxel budget. A 2.5GbE switch with more headroom is the honest answer there, even before you ask for VLANs. And the 12-camera row fits the fanless GS316PP with only 3W to spare, which is fine on paper but leaves nothing for a thirteenth camera. Cameras themselves never need more than a gigabit port; the 2.5GbE question is only about the access points.
Quick picks
- Best overall (cameras + modern APs): TP-Link Omada SG3210XHP-M2: eight 2.5GbE PoE+ ports on 240W, dual 10G SFP+ and a managed OS for a camera VLAN. Around $385, check the live price.
- Best unmanaged 2.5GbE for an edge closet: Zyxel XMG-108HP: eight 2.5GbE PoE++ ports, a 10G SFP+ uplink and no fan. About $120.
- Best value 8-port (all powered): TP-Link TL-SG1008MP: every one of its eight gigabit ports does PoE+ on a 126W or bigger budget. Around $90.
- Best budget (small setup): TP-Link TL-SG1005P: four PoE+ ports, fanless, silent on a shelf. About $45.
- Best silent smart switch: NETGEAR GS108EPP: all eight ports PoE+ on 123W, VLANs and per-port control, and no fan. Around $160.
- Best for high-power APs and PTZ: MokerLink POE-10G07110GSM: 802.3bt up to 90W on seven 10G copper ports. About $340.
- Best 16-port for 10+ cameras: TP-Link TL-SG1218MP: sixteen PoE+ ports on 250W, two combo SFP uplinks, rack mount. About $160.
If you are already deep in Ubiquiti, jump to the UniFi note below. If you only need ports and no power at all, the unmanaged gigabit and 2.5G switch guide covers the plain desktop switches.
How we picked these
Every spec below comes from the product page or datasheet of the maker (TP-Link, Omada, Zyxel, NETGEAR, MokerLink). We checked each one against the live Amazon listing for the exact model, and the PoE wattages against the IEEE figures rather than a rounded marketing number. Prices and stock came from the Amazon catalog the week this went out. Read them as bands and click through for the live number.
We did not lab-test all seven side by side. We have run cameras and APs off switches like these for years, though, and the problems we flag are the ones that actually show up:
- a fan you hear from the next room
- ports that carry data but no power
- PoE+ where a device wanted PoE++
- a budget that runs out when the IR comes on
Two picks changed since the September version of this guide. The fanless NETGEAR GS308PP, our old value pick, showed only a future ship date on Amazon when we checked. The TL-SG1008MP took its slot, and the Zyxel came in for readers who want 2.5GbE without a managed switch.
At a glance
| Switch | PoE ports | PoE standard | Power budget | Port speed | Uplink | Managed | Cooling |
|---|---|---|---|---|---|---|---|
| TP-Link SG3210XHP-M2 | 8 of 8 | 802.3af/at (30W) | 240W | 2.5GbE | 2x 10G SFP+ | L2+ managed | 2 fans |
| Zyxel XMG-108HP | 8 of 9 | 802.3bt Type 3 (60W) | 100W | 2.5GbE | 1x 10G SFP+ | Unmanaged | Fanless |
| TP-Link TL-SG1008MP | 8 of 8 | 802.3af/at (30W) | 126W to 153W | Gigabit | None | Unmanaged | 1 fan |
| TP-Link TL-SG1005P | 4 of 5 | 802.3af/at (30W) | 65W | Gigabit | None | Unmanaged | Fanless |
| NETGEAR GS108EPP | 8 of 8 | 802.3af/at (30W) | 123W | Gigabit | None | Smart (Easy Smart) | Fanless |
| MokerLink POE-10G07110GSM | 7 of 8 | 802.3bt (90W) | 260W | 10G on every copper port | 1x 10G SFP+ | Web managed | Fan-cooled |
| TP-Link TL-SG1218MP | 16 of 18 | 802.3af/at (30W) | 250W | Gigabit | 2x combo SFP | Unmanaged | 2 fans |
1. TP-Link Omada SG3210XHP-M2: best overall
This is the one we steer most people to for a mixed camera and AP setup, because it solves the 2026 problem in one box. All eight ports run at 2.5GbE, so a Wi-Fi 6E or Wi-Fi 7 access point actually gets more than a gigabit. Two 10G SFP+ ports feed a NAS or trunk back to the core. Every port does PoE+ on a 240W budget. It is also a real L2+ managed switch, so the cameras can sit on their own VLAN instead of talking to everything on the LAN.
Who it is for: anyone running multi-gig APs alongside cameras who wants VLAN segmentation and 10G uplinks without paying for enterprise gear.
Skip it if: the two fans are a dealbreaker. It is a 1U switch and it is audible, so it belongs in a closet or a rack rather than on a desk. It is also PoE+ only, which caps each port at 30W. And 240W across eight 30W ports leaves no headroom if every port pulls its maximum, so run the budget math before you fill it.
Central management needs an Omada controller, either the OC200 or OC300 hardware or the free software controller, which runs fine in Docker. Standalone, it still has a full web UI. The Amazon buy box was a third-party reseller when we checked, at around $385, so check the live price and the seller before you order.
2. Zyxel XMG-108HP: best unmanaged 2.5GbE for an edge closet
A small closet at the far end of the house usually holds an AP or two and a couple of cameras. Nobody wants to configure anything there. The XMG-108HP fits that job: eight 2.5GbE ports, all of them PoE++ at up to 60W each, plus one 10G SFP+ uplink and a fanless metal case. The Zyxel spec page lists the eight-port PoE model at a 100W budget. It is plug and play, with nothing to log in to.
Good fit: two Wi-Fi 7 APs and a few cameras in a closet or a garage. Silence matters there, and the APs should get their full 2.5GbE.
Pass on it when: the total draw goes much past 80W. The ports are rated for 60W each, but the whole switch shares 100W. One 802.3bt AP and a few cameras use it up, and the four-camera, two-AP setup from the sizing table already needs 102.5W. It is also unmanaged, so there is no camera VLAN, and the SFP+ uplink needs an SFP+ module or a DAC cable to reach the main switch. About $120, sold by Zyxel’s own Amazon store when we checked (it lists at $150).
If the closet only holds four powered devices, look at the fanless TP-Link TL-SG105PP-M2. It has five 2.5GbE ports, four of them PoE++ at up to 60W, on a bigger 123W budget for about $140.
3. TP-Link TL-SG1008MP: best value 8-port
When you want all eight ports powered and do not want to ration watts, this is the cheapest way there. Every one of its eight gigabit ports does PoE+, on a shared budget that comfortably covers eight standard cameras with the 25 percent reserve. It is the “power everything and forget it” box, with nothing to configure.
The budget number itself needs a careful read. The TP-Link spec page for the current V4 hardware lists 153W. The Amazon listing is still titled as the 126W revision, so you may receive either depending on stock. Both give far more real headroom per port than an 83W switch; just plan around 126W unless the box in your hands says 153W.
Right for: six or seven cameras plus an AP, where simple matters more than VLANs.
Look elsewhere if: it has to be silent. Unlike the smaller TP-Link boxes, this one has a fan, so it is not a living-room switch. It is unmanaged and gigabit only, so a Wi-Fi 7 AP runs at gigabit on it. Around $90, check the live price.
4. TP-Link TL-SG1005P: best budget
Five gigabit ports, four of them PoE+, fanless, in a palm-sized metal box. For two or three cameras and an AP at the edge of the house, this is the cheapest thing worth buying. The fifth port is a non-PoE uplink back to your router.
Buy it for: a garage camera plus an AP, a satellite location, anywhere you need a few powered ports and silence.
The catch: 65W across four ports is realistically two or three cameras plus a light AP, not four 30W loads. Do not confuse it with the TL-SG1005P-PD, which is a PoE-powered pass-through unit with no wall adapter and a completely different job. It also has an Extend mode switch that pushes PoE out to 250 m for a far gate camera. Those ports drop to 10 Mbps in that mode, and TP-Link rates it for two cameras. About $45.
5. NETGEAR GS108EPP: best silent smart switch
For a lot of homelabs this is the right compromise. All eight ports do PoE+ on a real 123W budget, the Easy Smart web UI gives you VLANs and per-port PoE control, and there is no fan at all. You get the camera isolation of a managed switch with the silence of an unmanaged one, at a fair price.
Who it is for: someone who wants a camera VLAN, all eight ports powered, and a switch quiet enough to sit in a living space.
Not for you if: you need 2.5G or 10G. It is 802.3at and gigabit only with no SFP, so it caps a multi-gig AP the same way any gigabit switch does. When you buy, get the GS108EPP (123W), not the similarly named GS108EP or GS308EP, which are the weaker 62W versions. Around $160, sold by Amazon.
6. MokerLink POE-10G07110GSM: best for high-power APs
Every other pick tops out at 30W per port, or 60W on the Zyxel with only 100W to share. This one is the reason you would pay up. It does 802.3bt PoE++ at up to 90W a port on all seven of its 10G copper ports, on a 260W budget, plus a 10G SFP+ uplink. A high-end Wi-Fi 7 AP whose datasheet lists 802.3bt, or a heated PTZ camera that needs more than 30W, has somewhere to plug in. The AP is not capped at gigabit while it is there, either.
Made for: 802.3bt Wi-Fi 7 APs, PTZ or heated cameras, or a core switch where you want 10G and 90W headroom on the powered ports.
Skip it if: your gear is happy on 30W, which most cameras and dual-band APs are. It is a fan-cooled metal box, so it is closet gear. It is also the one pick here from a value brand rather than a name you already know. The port count, read honestly, is seven 10G copper ports, all PoE++, plus one 10G SFP+, eight in total. The Amazon listing showed limited stock from a third-party seller when we checked, at about $340.
7. TP-Link TL-SG1218MP: best 16-port for 10+ cameras
Once you pass eight cameras, an 8-port switch runs out of ports before it runs out of watts. Daisy-chaining two small switches only adds another failure point. This is one of the two cheapest clean ways to one switch for a whole property: sixteen gigabit PoE+ ports on a 250W budget, two more non-PoE gigabit ports, and two combo SFP slots for the uplink. At Reolink’s 10W maximum per standard camera, that budget covers all sixteen ports with room to spare.
Who it is for: ten to sixteen cameras on one NVR or Frigate box, or a mixed rack of cameras, APs and IP phones with nothing to configure.
Leave it on the shelf if: it has to be quiet. It is a 1U rack switch with two fans. The TP-Link V4 spec sheet lists 298.55W maximum consumption (measured at 220V) with the full 250W PoE load connected. Size the UPS behind it for that, not for the 19.71W it pulls empty. It is also unmanaged, so there is no camera VLAN.
The fanless alternative got interesting this month. The NETGEAR GS316PP does sixteen PoE+ ports on 183W, and it was selling at about the same $160 when we checked. You trade 67W of budget for silence at no extra cost. Past sixteen cameras, the Omada SG2428P gives you 24 PoE+ ports on 250W, four SFP slots, 6 kV surge protection and real VLANs. It is about $310 from a third-party reseller. The TL-SG1218MP itself is about $160.
A note for UniFi and Omada people
If you already run a UniFi console, the ecosystem pick is the USW-Pro-Max-16-PoE. It has twelve gigabit PoE+ ports, four 2.5GbE PoE++ ports, two 10G SFP+ and a 180W budget, and the fanless USW-Lite-8-PoE is the small entry point. Buy it direct: the Ubiquiti store listed the Pro-Max at $399 ($439 with the Ubiquiti surcharge), while the only Amazon offer was a third-party reseller at about $525 when we checked. None of the UniFi switches are standalone; they need a UniFi console or controller to manage. If you are in Omada instead, the SG3210XHP-M2 above is the Omada-native managed pick.
Why port count misleads (and what PoE standard you need)
The most common PoE mistake is buying by port count. You see “8-port PoE,” hang eight devices off a 65W or 83W budget, and then cameras drop offline, APs reboot every few hours and a PTZ freezes mid-pan. Two things cause it, and both are on the spec sheet if you read past the product name.
The ports do not each deliver 30W. A switch sold as “8-port PoE, 83W” cannot run eight devices at a full 30W, because that needs about 240W. The wattage on the box is a shared pool, not a per-port guarantee. That is why the sizing at the top adds up real draws (a camera that pulls 8W takes 8W, not 30W). The reserve covers night IR, heaters and the next device you add.
Count powered ports, not total ports. Plenty of “8-port PoE” and “5-port PoE” switches power only half their ports. That is why the TL-SG1005P above is listed as four of five, and it is the trap in the switches we tell people to avoid below.
A PoE standard’s headline wattage is also measured at the switch port, and the device gets less after cable loss. That is why a 60W 802.3bt port only guarantees about 51W at the camera. The full picture, from the IEEE standards:
| Standard | Type | Max at the switch port | Guaranteed at the device | Pairs used |
|---|---|---|---|---|
| 802.3af (PoE) | Type 1 | 15.4W | 12.95W | 2 |
| 802.3at (PoE+) | Type 2 | 30.0W | 25.5W | 2 |
| 802.3bt (PoE++) | Type 3 | 60W | 51W | 4 |
| 802.3bt (PoE++) | Type 4 | 90W | 71.3W | 4 |
Most cameras and mainstream dual-band APs live happily on 802.3at (30W). You need 802.3bt (60W and up) only for high-end 4×4 or 10GbE Wi-Fi 7 APs whose datasheet lists 802.3bt, heated or high-power PTZ cameras and the odd LED panel. The mechanics of detection, classification and cable loss are in our explainer on how Power over Ethernet works. The numbers above are cross-checked against the Ethernet Alliance 802.3bt overview.
How many cameras can a PoE switch power?
Divide the PoE budget by 1.25 to keep a 25 percent reserve, divide that by the maximum draw of one camera, and cap the answer at the number of powered ports. The hard part is the per-camera number. Use the maximum, because that is what every camera pulls at the same moment when the IR comes on at dusk. These are the published maximums for common devices:
| Device | Maximum draw | Lowest standard that covers it |
|---|---|---|
| Standard bullet or dome camera, under 8MP (Reolink) | 10W | 802.3af |
| 12MP or dual-lens camera (Reolink Duo 3 PoE) | 11W | 802.3af |
| 4K camera, Amcrest IP8M-2796EW-AI | 7.2W | 802.3af |
| PTZ camera (Reolink RLC-823A) | 24W | 802.3at |
| PoE floodlight camera (Reolink Duo Floodlight PoE) | 28W | 802.3at (Reolink spec) |
| Wi-Fi 6 AP (UniFi U6 Lite) | 12W | 802.3af |
| Wi-Fi 7 AP (UniFi U7 Pro) | 21W | 802.3at |
Reolink’s figures come from its power consumption table, the AP figures from Ubiquiti’s tech specs, and the Amcrest number from its datasheet. Two caveats. Reolink puts its 4K (8MP) single-lens models in the 11W tier; at 11W the Zyxel drops to 7, the GS316PP to 13 and the SG2428P to 18; every other row holds. The Duo Floodlight PoE is specified for 802.3at, yet its 28W peak with the lights on sits above the 25.5W PoE+ guarantee at the device. Give it a port with budget to spare. Applying the formula to every switch in this guide gives the real camera count:
| Switch | PoE budget | Powered ports | Standard cameras (10W) | PTZ cameras (24W) |
|---|---|---|---|---|
| TP-Link TL-SG1005P | 65W | 4 | 4 | 2 |
| Zyxel XMG-108HP | 100W | 8 | 8 | 3 |
| NETGEAR GS108EPP | 123W | 8 | 8 | 4 |
| TP-Link TL-SG1008MP (126W revision) | 126W | 8 | 8 | 4 |
| TP-Link SG3210XHP-M2 | 240W | 8 | 8 | 8 |
| MokerLink POE-10G07110GSM | 260W | 7 | 7 | 7 |
| NETGEAR GS316PP | 183W | 16 | 14 | 6 |
| TP-Link TL-SG1218MP | 250W | 16 | 16 | 8 |
| TP-Link Omada SG2428P | 250W | 24 | 20 | 8 |
Two things fall out of that table. Every 8-port pick runs a full set of standard cameras (seven on the MokerLink, which powers seven ports). For most homes the choice between them is about fans, VLANs and uplink speed rather than watts. PTZ cameras change everything, though. At 24W each, the Zyxel carries three and the TL-SG1005P two. A pair of PTZs plus a few fixed cameras is the classic way people end up with cameras rebooting every night.
Do you need a PoE switch if your NVR has PoE ports?
Often not, at first. Many NVR kits power cameras straight from the recorder. The Reolink RLN8-410, for example, has eight built-in 802.3af/at PoE ports at up to 25W each. Those ports sit on a network of their own inside the NVR, which keeps the cameras off your LAN without any VLAN work. The fine print matters, though. Reolink says it records up to twelve cameras, but only eight of those can be PoE or plug-in cameras (the other four channels are for its battery Wi-Fi cameras). The camera ports are also 10/100. A ninth wired camera means a bigger NVR such as the RLN16-410, and a camera beyond 100 m of cable needs a switch or extender partway along the run.
You also need a switch the moment the recorder is a computer rather than an appliance. A Frigate NVR box or a Blue Iris PC has one or two Ethernet ports and no PoE, so every camera hangs off a switch. In that case put the cameras on their own VLAN, which is the next question.
Do security cameras need a managed switch?
They need one only if you want to isolate them, and you probably should. Budget cameras phone home to cloud services and run firmware you cannot audit, so the usual homelab pattern is a camera VLAN that can reach the NVR and nothing else. That needs 802.1Q VLAN support, which rules out the unmanaged picks here (Zyxel XMG-108HP, TL-SG1008MP, TL-SG1005P, TL-SG1218MP, GS316PP). The GS108EPP, SG3210XHP-M2, MokerLink and SG2428P all do tagged VLANs. If VLAN tagging is new to you, this VLAN configuration walkthrough covers the concepts, which carry over to any vendor’s web UI.
An unmanaged switch is still a fine choice when the cameras only ever talk to an NVR that has its own PoE network. It also works when the whole switch is dedicated to cameras and uplinks into a firewall port that does the isolation for you. A Zyxel in a closet that carries only cameras fits that shape. Put cameras and APs on the same unmanaged switch, though, and nothing isolates them from each other.
Switches to avoid (the half-power trap)
Two popular listings look like eight-port PoE switches and are not:
- TP-Link TL-SG1008P: despite “8 Port” in the name, only four ports are PoE, on a 64W budget. Its bigger sibling, the TL-SG1008MP above, is the real all-eight-PoE unit.
- Zyxel GS1200-8HP: same story, only four of its eight ports deliver PoE, on 68W in the current v3 listing.
Both are fine if you know what you bought and a nasty surprise if you plugged devices into ports five through eight expecting power. The rule that catches both: read the spec line for how many ports are powered and what the total budget is, never the port count in the product name.
What we would actually buy
Wiring a house today with a mix of cameras and Wi-Fi 7 APs, we would put the Omada SG3210XHP-M2 in the rack for the 2.5GbE ports and the camera VLAN, and accept the fan noise. Any closet that holds an AP and a couple of cameras gets a Zyxel XMG-108HP hanging off its SFP+ port, knowing the cameras and the AP in that closet share one segment with no isolation between them. Where gigabit is enough, the GS108EPP gives you VLANs and eight powered ports with no fan. The TL-SG1008MP powers all eight ports for less if you can live with a small fan and no VLANs.
Past eight cameras, skip the second small switch and go straight to the TL-SG1218MP, or the GS316PP if the rack is in a room you sit in. Reach for the MokerLink 10G PoE++ only when a device on your list really asks for 802.3bt. Whatever you pick, add up the maximum draws, keep the 25 percent reserve and count the powered ports. Do that, and the cameras will still be online the morning after the first cold night.
