Many things can cause this. Configuration can be anything. Please share the config (" /export hide-sensitive file=yourfilename" and attach the *rsc file in your post)
Just to start: a default hAP ac2 has ether1 as WAN and other interfaces connected to the bridge. The bridge is in the “LAN interface list”.
This LAN and WAN interface list is important in the default config settings. Access is only allowed to the members of the LAN interface list.
If you disconnect ether3 from the bridge, then don’t forget to add ether3 to the LAN interface list. Idem dito for any other interface.
You could also edit the config to remove the blocking rules, but using the LAN interface list is the easiest way.
If you want VLAN’s forwarded and filtered by the bridge/switch over multiple interfaces then the interfaces must be a port on the bridge. Setting ether1 as trunk is done in the bridge, just as the untagged interfaces are defined there.
See http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1