Wireless Access

I have a AP335 connected to a Cisco 2 Member Switch Stack.

AP01(AP335) eth0 is on Member 1 port gi1/0/1.

AP01(AP335) eth1 is on Member 2 port gi1/0/1.

I enabled Striping on the Controller.

The switchports are configured for switchport access.

Connectivity appears normal on the AP335.

However, I see several errors in the log: %SW_MATM-4-MACFLAP_NOTIF:.

What is the recommended/best practice switchport configuration for a dual uplinked AP335 on Cisco 3850?

Have you configured your switch side for LACP Etherchannel? A MAC Flap notification means that a device hops from one port to another, which is expected if you haven't told the switch that the two ports reach out to the same device.

Initially, I was advised to configure the switch ports as straight access ports, not LACP. Now, I have the ports in a passive port-channel. I continue to see the mac flap on the port. The mac address flagged in the flapping appears to be the AP335 Wired MAC Address, not the AP335 eth0 or eth1 interface mac address. 

Do you know or can you check what the reported MAC address is and what device it belongs to?

The mac address detected in the mac flap is the Wired MAC Address of the AP335. I confirmed the mac by logging to the controller and running show ap database long. 

Hi,

look into subchapter "Link Aggregation Support" of chapter "AccessPoints" in user guide (im citing guide of version 8.3.0).

• If an AP’s uplink access switch ports are configured in static port-channel mode, then the AP will set the Ethernet bonding mode to static port-channel (xor mode) only if gre-striping-ip is configured. If grestriping-
  ip is not configured, then the AP goes back to active-standby mode. In this scenario, the AP may go down depending on the behavior of the upstream switch.
• If an AP’s uplink access switch ports are configured in dynamic LACP mode, the AP detects LACP-PDUs and automatically sets the Ethernet bonding mode to LACP. If gre-striping-ip is not configured, then the AP’s
  Ethernet bonding mode will continue to be in LACP mode, but the AP will send GRE traffic only through one Ethernet port.

So the AP is autodecting, wether it should form a channel or not. If it sees LACP-BPDUs it will try to form a channel. So this is equivalent to ciscoes "channel-group mode passive". Listen if someone talks to you and then answer. But do not start conversation by yourself.

Thus, mode active is needed on your switch. AP will not start LACP negotiation. But it will answer.

First bulletpoint above better should read: "If an AP’s uplink access switch ports are configured in static or lacp-passive port-channel mode..."

Regards, Jörg

Thanks for the info Jörg. So, the AP335 uplinks are in a passive port-channel. The AP335 Uplink switchport interfaces are clean. No interface resets. No Unknown Protocol Drops. No Input Errors.

And I have Striping configured and enabled on the Controller. Although, Controller is running 6.5.4.8 OS. The code version should not be an issue. 

When I change the channel-group mode from passive to active, the AP335 remains active for about 45 seconds then drops, with an Suspended interface, which I expected.

I pulled the following document from community boards. 

https://community.arubanetworks.com/t5/Controllerless-Networks/Aruba-Instant-IAP-2250-US-with-Cisco-3750X-48P-S/td-p/199531

On the Controller, I created a new profile for both AP Ethernet Interface Port 0 and 1, set the switchport mode to trunk, along with the allowed/native vlan.

On the Switch, I modified the switchport interface - changed switchport mode trunk(native/allowed vlans) and set the port-channel mode to active. Both AP335 interfaces appear normal. No mac-flap entries in the logs.

When I run show mac address interface port-channel x, the AP335 MAC Address appears now. 

Hi,

you have to configure channels/link aggregates identically on both sides.

If you use LACP at one end, you have to use LACP on the other end also.

To be sure, that lacp negotiation starts, I prefere to set both side to active, allthoug passive should work, if APs send LACP packets.

After configuring the channels and connecting the APs you should prove consictency e.g. by issuing show commonds (show lacp, show logg  and likewise).

E.g. all members should be selected. Non standby or errordisabled.

On Ciscoes you might have to configure channel-protocol LACP. Cisco also uses PAgP as a channel control protocol. But mode passive/active should select LACP automatically nowadays...

Just to be sure:

Did you check, that the errormessage is truely related to the two portchannel member ports? If client roams from one AP to another, this can also generate MAC flaps.

Regards, Jörg

On the Controller, under the AP Ethernet Interface Profile/Wired AP, the only options access or trunk. There doesn't appear to be an LACP option available to put the AP Interface into a Port-Channel Group.

The Controller Uplinks are in a Port-Channel. That is working fine. 

Where did configure the AP Ethernet Interface 0 and Ethernet Interface 1 Port as a Port-Channel?