Reagrding post #9:
Setting frame-types= and the defintions in /interface bridge vlan have no effect when the bridge has vlan-filtering=no.
As noted in the documentation “On QCA8337 and Atheros8327 switch chips, a default vlan-header=leave-as-is property should be used. The switch chip will determine which ports are access ports by using the default-vlan-id property. The default-vlan-id should only be used on access/hybrid ports to specify which VLAN the untagged ingress traffic is assigned to.”
You cannot set vlan-filtering=yes as this is what disables the hardware offload to the switch chip, the results of mixing a VLAN-aware bridge and configuring the switch chip is not defined.
/interface bridge
add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=sfp1
/interface vlan
add interface=bridge1 vlan-id=99 name=MGMT
/interface ethernet switch port
set ether1 vlan-header=leave-as-is vlan-mode=secure default-vlan-id=10
set ether2 vlan-header=leave-as-is vlan-mode=secure default-vlan-id=20
set ether3 vlan-header=leave-as-is vlan-mode=secure default-vlan-id=99
set switch1-cpu vlan-header=leave-as-is vlan-mode=secure
/interface ethernet switch vlan
add ports=ether1,switch1-cpu switch=switch1 vlan-id=10
add ports=ether2,switch1-cpu switch=switch1 vlan-id=20
add ports=ether3,switch1-cpu switch=switch1 vlan-id=99
/ip address
add address=192.168.99.1/24 interface=MGMT
gives:
ether1 - VLAN 10 untagged
ether2 - VLAN 20 untagged
ether3 - VLAN 99 untagged
sfp1 - VLAN 10,20,99 tagged
and the Mikrotik is accessible on VLAN 99 with address 192.168.99.1