EAPS Protected VLAN Mismatch at an MLAG Core
Four X670 switches form a Layer 2 ring. SW1 and SW2 are an MLAG pair at the core; SW3 and SW4 are access switches. EAPS domain 'ring1' uses control VLAN 4000 and protects VLANs 10 and 20. SW1 is EAPS master. The MLAG peer link carries VLANs 10, 20, and 4000. The ring has been stable for months. An engineer adds VLAN 30 to the EAPS protected VLAN list on SW1, SW2, and SW3 but forgets SW4. Within minutes, users report broadcast storms lasting about 20 seconds, then recovery. 'show eaps' on SW1 reports the ring as COMPLETE. 'show stpd' shows MSTP blocking on one EAPS ring port for VLAN 30, while VLANs 10 and 20 are not blocked there. No EAPS shared port is configured.
1. What is the most likely cause of the transient loop, and why did EAPS report COMPLETE?
Read the worked answer
EAPS protects only VLANs explicitly in its protected VLAN list on every node. VLAN 30 was added to SW1, SW2, and SW3 but not SW4, so SW4 still forwards VLAN 30 as an ordinary STP VLAN. EAPS can declare the control ring COMPLETE because control VLAN 4000 is consistent, but it is not blocking VLAN 30 at the ring master. MSTP then sees a loop for VLAN 30 and blocks one ring port, causing the transient storm until convergence. The mismatch is the cause, not an EAPS control-plane failure.
2. What design rule does this violate, and how should EAPS and MSTP be separated at the ring boundary?
Read the worked answer
It violates the rule that the EAPS protected VLAN set must be identical on all ring nodes and that EAPS and STP should not both control the same ring ports. Inside an EAPS ring, STP should not be responsible for breaking the ring; disable STP on EAPS ring ports where the design allows, and use an EAPS shared port or a clear MSTP boundary when connecting to an STP domain. Never use STP as a safety net for a partially configured EAPS VLAN.
3. Give a safe procedure to add VLAN 30 to the ring.
Read the worked answer
Pre-check all nodes with 'show eaps', 'show vlan', 'show stpd', and the EAPS protected VLAN list. Add VLAN 30 to SW4 first, or use a maintenance order that keeps the protected set consistent at each step; better, add it on all four nodes in a coordinated window. If supported, use the EAPS shared-port procedure for the boundary. After each step, verify EAPS COMPLETE, no STP blocking on ring ports for VLAN 30, and no broadcast storm. Then save config on all nodes. Never leave a partial protected VLAN list.