It’s also worth to mention that hEX series has crappy switch chip while hAP ac2 has pretty decent one with VLANs support and stuff so you can also repurpose your device as managed L2 wire-speed switch. For me it was big deal as I wanted to loop traffic through IPS and ROS has issues with software bridging the same connection twice, so the only way was to make traffic “invisible” for ROS after it reaches IPS using switch chip vlan filtering. Issue with double bridge is described here: http://forum.mikrotik.com/t/loopback-nat-is-performed-only-once/121914/1