Hi Julie,
a sporadic mac address flapping is not a problem; if on the contrary you see the messages often there might be an underlying isue somewhere.
How often do you see the flapping?
Assuming that you see the flapping messages quite often it seem that your traffic is somehow looped within your ring. Considering that you don't mention any major issue (CPU up to the sky... protocols flapping and traffic dropped) I think that some traffic is sporadically looped.
Regarding the specific MAC address in vlan 201 0021.056b.bc1c the message says that traffic from that host is seen from local LAN port and from the WAN port. Of course that cannot be.
Where does that host reside exactly?
Have you checked whether your STP topology is coherent? One of the 4 switches (let's focus on vlan201) should be the root bridge for that vlan and the farthest one (2 hops away) should have a port in blocking state. If you check the outputs do you see one port in blocking state?
Can you check if you have increasing Topology changes in that vlan (show spann vlan 201 detail - you will see the number of TCs and the port a TC was received/triggered last - take the outputs multiple times to see if TCs increase).
About the WAN 400GB Ethernet link - which technology is that? Not sure how you can terminate a 400GB link on a ME3400 which does not have Terabit ports. Did you mean 400Mb maybe? If this is the case can you check if you have output drops on G0/15 of all the me3400? Likely you won't see any but it is better double check. If we have drops they will occur in your SP cloud where I suppose they configured a policer at 400Mb. Other assumption we need to verify is that if you have drops in the SP cloud some BPDU's are dropped too causing temporary reconvergences and TCs. During reconvergences it is quite normal that we see Mac flapping as it can happen that all ports are FWD. This is why you need to check TCs and STP status.
Also do you have stats regarding average throughtput on your Gi0/15 interfaces? Do you have peaks above the CIR your SP gives you?
Well, this might be a good start; depending on your answers we might do other checks.
Riccardo
