Netgear Managed Switch (PoE)

The Netgear Managed Switch driver controls the PoE ports on Netgear managed switches — the M4250 / M4350 AV-line family and compatible models — so GEM can cut PoE power to a port, restore it, or power-cycle a hung powered device. The classic use is putting a PoE camera, access point, intercom, or PoE-powered display under automation: a trigger or a maintenance macro bounces a frozen camera's port, or an "away" scene sheds power to non-essential ports — the network-closet equivalent of pulling and re-seating the patch cable, without a trip to the rack.

GEM talks to the switch's local management REST API over HTTPS on port 8443, logging in with the switch's admin credentials and controlling PoE per port.

This is a command-only driver — no zones, no live port feedback

Unlike the TP-Link Managed PoE Switch driver, this driver does not create zones and does not poll or display each port's live PoE state. You drive it by sending PoE commands (from a macro, a trigger, or the Commands tester), naming the port in the command's address argument. GEM fires the command and reports success or failure, but it does not show a running on/off indicator for each port. If you need a live per-port on/off tile, that expectation belongs to a different device.

Point at the switch, not a controller

This driver connects directly to the switch at the switch's own IP, on its local REST API. The switch must have its local management API enabled and an admin password set. This is different from the UniFi Switch driver, which talks to a UniFi controller rather than the switch itself.

Prerequisites

• A Netgear managed switch with PoE ports — the M4250 or M4350 family, or another Netgear model exposing the same local REST API.
• The switch's local management REST API enabled. On most firmware this is on by default; if login fails, enable it in the switch Web UI under its Maintenance / System settings.
• An admin account on the switch with REST access, and its password.
• The switch reachable from the GEM controller over HTTPS on port 8443 (this port is fixed — see below).
• The port numbers you intend to control, as printed on the switch faceplate.

Setup

1. Create the device. Go to System → Devices (Open Devices), add a device, and pick Netgear Managed Switch (PoE) as the driver. Set Enabled to Yes.
2. Fill in the connection fields — these three are all you need:
   • Switch IP (ip) — the LAN address of the switch's management interface.
   • Admin Username (username) — an admin account with REST access.
   • Admin Password (password) — that account's password. Stored encrypted.
3. Save. GEM immediately logs in to the switch and caches a bearer token, then refreshes that token automatically about every 59 minutes for as long as the device is enabled. Confirm the device comes up connected.

There is no HTTP-port field: the driver always connects on HTTPS port 8443, which is the fixed port for the Netgear local REST API. The switch's self-signed certificate is accepted automatically, so you do not need to install a certificate.

Controlling PoE ports

Because this driver has no zones, you control a port by running one of its PoE commands and passing the port number in the command's address argument. The two everyday ways to do that:

• From a macro. Add a Send Command step, choose the switch as the device, set the command to port_poe_reboot (or port_poe_enable / port_poe_disable), and put the port number in the step's arguments as address — for example address = 4 for port 4. This is the normal way to automate a port. Attach the macro to a trigger or a schedule to make it run on its own.
• From the Commands tester. Open the switch's commands (the commands icon on its row in Devices, or via Commands), pick the switch as the Test Device, fill in the address argument with the port number, and use Test to fire the command. This is the quickest way to confirm a port responds while commissioning.

The port number is always supplied as the address argument — there is no zone address to fall back on, so a command with no address has nothing to act on.

What each command does

• port_poe_enable — turns PoE on for the port named in address. Powers up whatever the port feeds. This is a persistent change to the switch's PoE configuration; the port stays powered until something disables it again.
• port_poe_disable — turns PoE off for the port in address, cutting power to the connected device. Also persistent — the port stays off until you enable it again.
• port_poe_reboot — a one-shot power-cycle of a single port: disables PoE, waits, then re-enables it. The off interval comes from the command's delay argument in milliseconds, defaulting to 5000 (5 seconds) if you don't set one. Use this to bounce a frozen camera or access point without leaving it powered off. Note this reboots the device the port feeds, not the switch itself.
• login — forces GEM to re-authenticate and refresh its bearer token. GEM does this on its own schedule, so you rarely need it by hand; it's there if you want to prove the credentials still work.

warning

port_poe_disable leaves the port off

port_poe_disable is a persistent PoE cut, not a momentary one — the port stays dark until a later port_poe_enable. When you only mean to bounce a device, use port_poe_reboot, which restores power on its own.

Device attributes

Attribute	Label	Type	Notes
ip	Switch IP	string	LAN IP of the switch management interface (required)
username	Admin Username	string	Admin account with REST access (required)
password	Admin Password	string (secure)	Stored encrypted (required)
token	Bearer Token	string (secure, read-only)	The cached login token. GEM manages this automatically — leave it alone
token_time	Token Issued (epoch ms)	int (read-only)	When the cached token was issued. Diagnostic only

The token and token_time attributes are written by the driver each time it logs in; they exist for diagnostics and are not something you set.

Commands

Command	Args	Effect
port_poe_enable	address	Turn PoE on for the port. Persistent. address = faceplate port number
port_poe_disable	address	Turn PoE off for the port, cutting power. Persistent
port_poe_reboot	address, delay	Power-cycle the port: PoE off, wait delay ms (default 5000), PoE on. Reboots the powered device
login	—	Re-authenticate and refresh the bearer token. Runs automatically; available for manual verification

Limitations and quirks

• No live port status. GEM does not read or display whether a port is currently delivering PoE. Commands are one-way — GEM confirms the command succeeded or failed, but there is no polled on/off state for each port.
• No on/off zone toggles. There are no zones and no on / off verbs; every action is one of the explicit PoE commands above, driven from a macro, trigger, or the tester.
• Fixed 8443 / HTTPS. The management port is hard-coded to 8443 and the connection is always HTTPS with the switch's self-signed certificate accepted. There is no field to change the port or enforce certificate validation.
• PoE budget is written as 30 W. Each port_poe_enable / port_poe_disable also writes a fixed 30 W (30000 mW) power limit for that port. GEM does not expose a per-port budget field, so a device that needs more than 30 W of PoE (some PoE++ PTZ cameras and displays) may be capped when GEM toggles its port — power such loads on a port whose budget you manage on the switch itself, or avoid toggling it from GEM.
• Token auto-refresh. GEM logs in on connect and refreshes the token roughly every 59 minutes; a short burst of login activity in the logs around each refresh is normal.
• STP/LACP timing. Some models reject a PoE change while STP or LACP is renegotiating on that port. If a command fails, wait a few seconds and retry.

Troubleshooting

Symptom	Check
Device won't connect / login fails with a TLS or auth error	Confirm Switch IP, Admin Username, and Admin Password, and that the switch's local REST API is enabled and reachable on port 8443. Some firmware disables the API until it's turned on in the Web UI.
A PoE command reports it couldn't power the port	Confirm the address you passed is a real, PoE-capable port. Some models also reject changes while STP/LACP is renegotiating — wait a few seconds and retry.
A port turned off but the device never came back	port_poe_disable is a persistent cut — the port stays off until port_poe_enable. Use port_poe_reboot when you only meant to bounce the device.
A high-power PoE device browns out when GEM toggles its port	Each PoE write applies a fixed 30 W limit; a PoE++ load may need more than that. Manage that port's PoE on the switch and don't toggle it from GEM.
port_poe_reboot didn't recover a hung device	The device may need a longer down time than the default 5-second cycle. Set a larger delay (in milliseconds) on the reboot command, or run port_poe_disable, wait, then port_poe_enable from a macro.

Automation ideas

• Bounce a hung camera or AP. A trigger on a device going offline, or a scheduled overnight maintenance macro, runs port_poe_reboot on that port to power-cycle the device without leaving it off.
• Power a display with the room. Feed a PoE display from a switch port and let a room's on/off scene run port_poe_enable and port_poe_disable for that port alongside everything else.
• Load shedding. Have an "away" or energy-saving macro run port_poe_disable on non-essential PoE ports (signage, secondary APs) and port_poe_enable again when the site is occupied.

Related documentation

• Devices — adding the switch as a device and editing its connection settings.
• Commands — running port_poe_enable, port_poe_disable, and port_poe_reboot by hand from the tester to verify the link.
• Macros and Triggers — the Send Command step and event/schedule triggers that fire these PoE commands automatically.
• Device Health — watching the switch's own connection state.
• TP-Link Managed PoE Switch — a comparable PoE-switch driver that uses zones and polls live port state.
• UniFi Switch — the equivalent driver for Ubiquiti managed switches, driven through a UniFi controller instead of the switch directly.