MSM760 VLAN problems

[Parcival]

Dear community,

we got strange problems with our vlan settings for the Clients and APs...

The scenario is as follows:

5412 core (as vlan router) with different vlans (eg. 2 für private wifi networks)
all uplink ports to switches trunk these tagged vlans
Switchports with management interface for APs are untagged (vlan 500)
"VSC-vlans" (10, 20) are tagged on that switch ports.

We have a single windows DHCP with all regarding subnets for the respective VLANS

The Problems which occur:
- "normally" all APs get an IP out of management VLAN (500) - the switchport untagged vlan- "normally" clients get an IP of subnet (vlan) 10 or 20 regarding the connection to the specified network (VSC)
where the respective VLAN is egressed.

BUT from time to time APs get IPs of the client vlans 10 and 20 AND/OR Clients get IPs of the management VLAN...

How is this even possible?

Workaround regarding APs is to shut them down, getting only the Management vlan 500 up and after power on apply 10 and 20 to the switchport as tagged.

Doesn´t help the clients though...

I´m running in this problem at 3(!) installitions we have. the MSM760 are run in teaming mode. Management interface is LAN-Port and the Client vlans are at the internet port.

I really don´t know what i am missing or might have configured wrong...

please help with your suggestions :(