Spanning Tree Problems with Access Points connected to Procurve Switches

[simon_eng]

Anyone ever find switchports flapping on an off when Spanning Tree is active and an access point (7055, 7363, 7372, 7962) is connected? We have found this in several properties now with very similar configurations but have not been able to determine a cause. All of our hotels use Procurve switches at the edge (2910al-PoE or 2520-8G-PoE), all participate in spanning tree, but we only observe the flapping on about 1% of switchports. Of course, 1% for us means that 10-50 guests are getting knocked off the network regularly, so it is a bit of an issue (some ports have 200-300 state transitions *per day*.

We have verified that the configurations on the ports that have the problem match the ports that do not with regard to BPDU filtering, root-guard, etc. We do not believe that it is a deliberate attack because it is the same access points that have chronic issues, whereas the other 99% never do.

Any ideas?

[keith_redfield]

This is a great conversation that's separate from the main topic, so I created a new topic to continue the discussion. Please reference the new topic here: What happens when a AP connected to a wire is losing its wired connection

[brandon_chap]

I am not sure if you have figure out your problem yet, but we had this exact same issue. With bpdu-protection setting enabled for ports going to AP's we were seeing the AP drops. Our AP's were in a university dorm type setting. Since we were using 802.1x in the dorms and the protocol is not supported by gaming consoles, some of the students were bridging their laptops wireless to their laptop's LAN port. When this happens, the laptop attempts to participate in STP and sends a BPDU packet to the AP. Once it gets to the switch, bpdu-protection disables the port. We turned off bpdu-protection and kept bpdu-filtering set for the AP ports on the switch. This way the BPDU packet is just dropped and traffic continues to flow as normal. No more random AP drops. Hope this helps!

[simon_eng]

Hi Brandon,

Thanks, we will try that as well. Thanks!

[mitchell_axtell]

Another killer- Wake-on-WLAN uses BPDUs, so any newer Intel chip would happily send BPDUs, get the AP shut off, roam to the next AP and repeat until all in range were downed.

We have adjusted to remove BPDU protection from the AP ports.

Side note- I can recommend removing loop protect as well- I have seen it cause some issues when clients roam.

[simon_eng]

Well, that's handy. Thanks for the heads-up. We're going heads down for the next 2 days installing 70 switches and ~200 access points. This should be fun.