On Juniper EX/QFX switches, access/edge interfaces are not expected to receive STP BPDUs.

• If BPDUs are detected on a PC-facing port and BPDU protection is enabled, the switch can place the port in discarding state or force it down to protect the network from potential Layer 2 loops.
• Blocking BPDUs on the interface does not resolve the root cause if the connected device (or something behind it) keeps sending/forwarding BPDUs.

• Users lose connectivity on one or more access ports.
• Ports enter discarding and/or are taken down by BPDU protection.
• Logs show BPDU protection events followed by link-down traps/alerts.

l2cpd[xxxx]: L2CPD_RECEIVE_BPDU_BLOCK_ENABLED: BPDU_PROTECT: Interface ge-x/x/x is DOWN: BPDU error detected

mib2d[xxxx]: SNMP_TRAP_LINK_DOWN: ifIndex 718, ifAdminStatus up(1), ifOperStatus down(2), ifName ge-x/x/x

• Issue returns after re-enabling the port.

BPDUs are coming from something behind the drop, such as:

• an unmanaged switch, phone passthrough, AP/extender, or another switch
• a workstation with network bridging/virtual switching enabled
• a cabling/patching issue creating an unintended L2 loop

Solution / recommended steps

• Keep affected ports disabled until a maintenance window.
• Re-enable one port at a time and check neighbors / learned endpoints to confirm what’s connected.
• If needed, take a pcap (port-mirror) and check with Wireshark to confirm BPDU traffic and identify the source device type.
• Fix the source (remove downstream switch/bridge, disable host bridging, correct cabling). If the port is an uplink, treat it as an uplink instead of an access/edge port.

2026-02-25 : Article Created

2026-04-07 : Updated the categories.