MultiSSID and VLANS

Hi There,
I am trying to configure our Mikrotik cAPG_5HacD2Hnd WIFI Access Points,
We have 2 networks split via VLAN both already have DHCP Servers on them
The Devices connect into a TP Link Managed Switch where i have set the ports to General and allow both VLANS to access

here is the current config of my Wifi Access Point, but i can seem to get clients to access VLAN2 and pickup ip address, if i give a machine a static address i can connect ping the Wifi Access point on VLAN2 but not the Gateway \DHCP server

/interface bridge
add fast-forward=no name=Vlan2_Bridge pvid=2
add admin-mac=CC:2D:E0:A1:B2:F1 auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce disabled=no distance=indoors frequency=auto mode=ap-bridge name=Staff2Ghz rx-chains=0,1 ssid=HelStaff
tx-chains=0,1 wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-Ceee disabled=no distance=indoors frequency=auto mode=ap-bridge name=Staff5Ghz rx-chains=0,1 ssid=
HelStaff tx-chains=0,1 wireless-protocol=802.11
add disabled=no keepalive-frames=disabled mac-address=CE:2D:E0:A1:B2:F4 master-interface=Staff5Ghz multicast-buffering=disabled name=HGuest5ghz ssid=“Hel Guest” vlan-id=2
vlan-mode=use-tag wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/interface vlan
add interface=HGuest5ghz name=VLAN2_5Ghz vlan-id=2
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods=“” mode=dynamic-keys supplicant-identity=MikroTik wpa2-pre-shared-key=H3H3Trag
add authentication-types=wpa2-psk eap-methods=“” management-protection=allowed mode=dynamic-keys name=Guest supplicant-identity=“” wpa2-pre-shared-key=“GuestTraining”
/interface wireless
add disabled=no keepalive-frames=disabled mac-address=CE:2D:E0:A1:B2:F3 master-interface=Staff2Ghz multicast-buffering=disabled name=HGuest2ghz security-profile=Guest ssid=
“HelGuest” vlan-id=2 vlan-mode=use-service-tag wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/interface vlan
add interface=HGuest2ghz name=VLAN2_2Ghz vlan-id=2
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=Staff2Ghz
add bridge=bridge comment=defconf interface=Staff5Ghz
add bridge=Vlan2_Bridge interface=HGuest2ghz pvid=2
add bridge=Vlan2_Bridge interface=HGuest5ghz pvid=2
add bridge=Vlan2_Bridge interface=VLAN2_2Ghz pvid=2
add bridge=Vlan2_Bridge interface=VLAN2_5Ghz pvid=2
/ip address
add address=192.168.112.253/24 interface=Vlan2_Bridge network=192.168.112.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=bridge
/system clock
set time-zone-name=Europe/London
/system routerboard mode-button
set enabled=yes on-event=dark-mode
/system script
add comment=defconf name=dark-mode owner=*sys policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="\r
\n :if ([system leds settings get all-leds-off] = "never") do={\r
\n /system leds settings set all-leds-off=immediate \r
\n } else={\r
\n /system leds settings set all-leds-off=never \r
\n }\r
\n "


Any ideas where i have gone wrong and what i need to do to fix this.

thanks
Jamie

remove your vlan interfaces.
remove your “Vlan2_bridge” bridge.

Enable vlan filtering on your native bridge “bridge” and set it to pvid=2.
Then move the IP address to this bridge.
Add your virtual APs for guest access to that bridge and keep their vlan setting at vlan-id=2 and set tag mode to use-tag, not use-service-tag

And you’re there.

-Chris