I've spent quite a while sorting out how to prevent lightening from taking out our switch ports. It got really, really old being up during every storm, ready to swap cables.
We've finally found a solution that seems to work, and has weathered several very severe storms without frying any ports now. We use this on all our APs, and it's been quite solid once we got everything set up properly.
1. GROUND THE TOWER. GROUND THE TOWER. GROUND THE TOWER. We had issues from insufficient grounds on a tower - the ground wire was connected to a grounding rod, but it wasn't far enough into the ground. If you have a tower, it's worth it to have a professional ground it. If you're on a roof, tie into the building electrical system or plumbing system. The metal conduit on the side for electrical should be sufficiently grounded. Otherwise, make sure you know how far down the grounding rod has to be. It needs to be pretty deep.
2. Put a lightening arrestor on the antenna, before the antenna cable.
We use this for our 5.8 antennas: http://www.hyperlinktech.com/web/al6-nmnfb.php
And for the 900/2.4 links, http://www.hyperlinktech.com/web/al-nfnfb.php
This should be grounded to the tower. It will dump massive voltages to ground, and will blow the "fuse" if it gets hit hard - you'll want spare tubes around. This is a "catastrophic failure" prevention piece - without it, your radio will let out magic smoke.
3. Ground the radio. The radio should be grounded to the tower. This usually isn't an issue.
4. Surge protection before the PoE injector. We use these: http://wlanparts.com/c=*/product/SP-POE7-I1
in between the PoE injector & the radio. This surge protector needs a good ground, or it's useless. I've used a bus bar from Radio Shack to connect a bunch of them to a single ground.
5. Ground the PoE injector. Some don't have grounding. You want one that does. We've been using these, and haven't had any problems: http://www.wisp-router.com/product_info ... cts_id=117
Once we got all these in place and securely grounded, we haven't blown a switch port yet.