I have been going in circles on this and need some help. I am trying to setup a network setup with multiple APs (APGi-5HaxD2HaxD-US) that you can connect to for different networks in the building. I configured the router (CCR2004-16G-2S+PC) is connected to one AP on port 16 and the other AP is connected to a switch (CRS328-24P-4S+RM) that is running the latest version of SWoS. The problem i am having is that the AP (AP_PRGTY_BKSTG) that is connected to eth16 on the router itself is able to connect to PROD_LAN and authenticate with internet access. Connecting to the other SSIDs with fail, they connect but don't receive an IP. The AP (AP_HLL) is unable to get an ip on any of the SSIDs and it is connected to the switch on port 24 which is configured in SWOS for as part of each vlan, and it's set up as "strict", and "allow only vlan tagged" with an id of 1. the switch is connected back to the router through two sfp ports which have the same settings on the switch. I can't seem to figure out the settings that i am missing. I will say that both ap have their bridges set to "vlan filtering on but they have admit all selected. If i switch them to admit only vlan tagged i loose PROD_LAN connectivity on the AP_PRGTY_BKSTG ap even if i change it back. I have test ports on the router for each vlan and when i connect a pc to those ports i get the correct ips for each vlan. any insights would be greatly appreciated.

Diagram for reference Router Config AP_PRGTY_BKSTG Config AP_HLL config