The specific part of the above topic to focus on is the post about AP setup. Using RouterOS to VLAN your network - #4 by pcunite
Disclaimer, I have no MikroTik devices with wifi, so anything related to wifi setup is all second hand.
However, looking at the config on your cAP XL ac, these are the things I noticed.
You have not configured the wifi interfaces to be members of the bridge. This is the in the /interface bridge port section.
You have vlan interfaces (SVI in the cisco terminology you are using) for the data vlans vlan20 and vlan30 (which is configuring the cAP to be a router between those vlans, not what you want, because it will bypass the rb5009 firewall). The vlans should be defined in /interface bridge port and /interface bridge vlan but there should not be a "connection" to the routing engine in the cAP (via the SVI). Also you don't have a vlan interface (SVI) for vlan 100 (what you used as management interface on the 5009). For ease of management when the cap is on the ceiling, having a management vlan is what you want. The CAP should have only a single vlan interface (SVI) defined, and it should be for management. The other vlans should just be defined at the layer 2 level (bridge/switch) so the traffic will be kept separate for each SSID.
If you get things working by adding the wifi interfaces to the bridge, then you can just leave ether2 configured as an out of band management port. If doing that doesn't work, then there are some other things that could be done to use that port as an access port for one of the vlans (e.g. 20) just to verify that a device plugged into that port would be able to get an ip address (from the correct pool).
My steps would be (on cAP XL ac)
- Login from ether2
- Backup and export your current cAP config and save off the cAP before making any changes.
- Add vlan interface vlan100.
- assign ip address to vlan100 (distinct from the one used by RB5009 (192.168.100.1), e.g. 192.168.100.2)
- connect to 192.168.100.2 to verify that access works.
- log out from ether2, do rest of config from admin vlan100
- remove vlan20 and vlan30 vlan interfaces (SVIs)
- add wlan1 and wlan2 as bridge ports in each vlan 20 and vlan 30 (separate lines for each vlan)
- test to see if wifi works.
- protect access to vlan100 with firewall (at least before you stop configuration, although this would be my last step). Verifiy that you can't access from vlan30 (for sure). Whether you want to allow access from 20 is up to you, but it will be routed through the RB5009 if it is allowed.
Report back. If things still don't work, next will be to reconfigure ether2 as a bridge port in vlan 20, and to see if plugging a wired dhcp client (e.g. a laptop) will get an ip address from pool-vlan20 (which you didn't show in your "RB5009 config")