PoE+ Power Budget Allocation Deadlock on FortiSwitch 124F/148F Rebooting VoIP Phones
Picture this: scheduled weekend facility maintenance re-energizes your building, but Monday morning 8:00 AM arrives and thirty desk phones are clicking, flashing their display lights, and rebooting every ninety seconds. The switch has 200W of unused physical power capacity, yet its controller is aggressively shutting down edge ports.
Technical Root Cause Analysis
FortiSwitch edge models such as the FS-124F-POE (370W budget) and FS-148F-POE (370W budget) run the poed daemon alongside the hardware abstraction power_mgr driver to govern IEEE 802.3af (PoE, up to 15.4W) and IEEE 802.3at (PoE+, up to 30W) power negotiations. Under normal conditions, when a Powered Device (PD) like a Cisco, Polycom, or Yealink VoIP telephone connects, hardware Layer 1 resistive classification signals its IEEE class, followed by LLDP-MED packets that refine the requested allocation down to real operational draw (typically 4.5W to 7.8W).
Under Bug 0874901, when multiple VoIP phones power cycle simultaneously, a race condition occurs in the poed reservation ledger. Rather than waiting for LLDP-MED TLVs or measuring instantaneous shunt current, the daemon immediately reserves the maximum theoretical 30.0W for every Class 4 advertisement. Across 20 to 30 phones, the calculated reservation hits 370W instantly, even though the actual aggregate draw is under 90W. Believing the chassis is about to brown out, power_mgr triggers its low-priority port-shedding routine, cutting DC voltage to edge ports. Once those phones shut down, the phantom reservation drops, power is re-asserted, the phones draw inrush current, and the cycle loops forever.
The Fortinet Firmware Trajectory: This issue was first logged in FortiOS / FortiSwitchOS 7.0.8. Fortinet issued an initial workaround in 7.2.2 by allowing administrators to configure static power allocation profiles from the FortiGate switch controller. However, this required manual per-port overrides, and if a dual-band Wi-Fi 6 AP was mistakenly connected to a phone port, the AP was starved of power and disabled its 5GHz radio. Permanent, verified remediation was delivered in FortiSwitchOS 7.2.5+ and 7.4.1+, which completely overhauled poed with an asynchronous power allocation queue, staggered port power-on timers, and intelligent LLDP-MED fast-negotiation.
Affected Firmware & Blast Radius Matrix
| Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiSwitchOS 7.2 | 7.2.0 – 7.2.4 | 7.2.5+ | Apply static 10W allocation profile per port |
| FortiSwitchOS 7.4 | 7.4.0 | 7.4.1+ | Upgrade recommended; enable LLDP-MED power sync |
| FortiSwitchOS 7.0 | 7.0.8 – 7.0.12 | 7.0.13+ | Set port priority to critical for phones; stagger boot |
Platform Impact: FortiSwitch 108F-POE, 124F-POE, 148F-POE, 148E-POE, and 248E-POE deployed at enterprise branches and campus access layers running IP telephony.
Step 01: Free Verification CLI (Safe Read-Only)
Verify whether your FortiSwitch is currently experiencing a PoE allocation deadlock or port shedding directly from the FortiGate switch-controller CLI:
Diagnostic Commands
# 1. Check total allocated vs. consumed PoE power on the FortiSwitch
diagnose switch-controller switch-info poe <Switch-ID>
# 2. View port-level PoE status, hardware fault codes, and wattage
execute switch-controller get-sync-status <Switch-ID>
# 3. Enter switch console to view real-time poed daemon power ledger
# (From FortiGate CLI, execute: execute switch-controller connect <Switch-ID>)
diagnose switch poe status
diagnose switch poe dump
# 4. Check LLDP-MED negotiated power values
diagnose switch lldp neighbor-infoRemediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
Bug 0874901 causes poed to track allocated reservations instead of measured power. It assigns 30W to any Class 4 device upon link detection. Across 13 ports, 390W is requested, exceeding a 370W power supply even though each phone only draws ~6W.
Yes. You can push a FortiSwitch port profile from the FortiGate setting static power mode to 10W or 15W per port. The switch dynamically updates the reservation ledger without dropping PoE power to active ports.
No. FortiSwitch runs its own FortiSwitchOS firmware. While FortiGate manages the switch over FortiLink, you must upgrade the FortiSwitch image to 7.2.5+ or 7.4.1+ for the poed code fix to take effect.