Managment Vlan - CSS326-24G - hEX

Hi All

new to Mikrotik and interested to learn more.

I am running a CSS326-24G-2S+RM, hEX Router and cAP ax Access Point. It has multiple VLAN setups which are all running a dedicated DHCP server on the hEX. Took me a while to figure it out to get here but this is working all fine, also with seperate wifi configs - worked a lot through the wiki and yt videos.

BUT

I am freaking struggling to get a Management VLAN setup accross the devices. Here´s my thought process, I`d really appreciate if someone could help me out:

on hEX:
Created VLAN 99 (Management) under Interfaces, assigned dedicated IP address, added VLAN under Bridge with tagged Bridge and Ether 2 (Trunk Port on the router) in order to build the link between CPU and Switch Chip - Untagged Ether 5 (as AP).
Added DHCP server to VLAN 99 (functions well accross devices).

on CSS Switch:

Created VLAN 99 - under System enabled “allow from VLAN” to 99.

Issue:
Connected to VLAN 99 on switch - I can´t access the router. Connected to Ether 5 on Router I can´t connect to the switch.

Starting to get paranoid - any help appreciated. Could it be I have some FW trouble?

Thanks in advance!

Each device one bridge.
Router define all vlans, and the associated subnets, routing and firewall rules.
Decided what each smart device needs to pass on in terms of data vlans aka trunk port to these devices… add management vlan.
Smart Devices:
ONLY management vlan is defined and the Ip address is best set static to the manaegment vlan.
Firewall rules not required
Only the management vlan is tagged with bridge on /interface bridge vlan settings.

http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1