So, i have a two hAP AC lite that are connected to a switch, switch has those two ports tagged with two VLANs, one VLAN is for internal network, while other one is for the guest network.

You can see the configuration in the attached files. My question is this, i would like to take ether5 and assign it to the guest network as untagged port. My guess is that i would just pull it off switch bridge, and put it in the bridge_external. So far so good, but how can i switch between tagged and untagged on that interface?
(what i would like to do in the end is 3rd VLAN for network management on ether5)

Another question, in Winbox i get two more interfaces without IP address, my guess is that it's switch-bridge interface from each AP?
Is this normal? Did i configure this right?
And yes, i don't run any firewall on APs, since i handle internal and guest separation on the main router.

Thx

to "switch" between tagged and untagged - you need to have the untagged bridged to bridge1 (i would think this is a ethernet interface) and the tagged frame to bridge 2 (this is a vlan). Then you need to bridge the 2 bridges, by a vlan 3. its a pain setup. its possible in some setup to just bridge vlan, bridge and untagged port.

better to route between networks in this setup.

the "interface" you see, is actually the mac address of the vlan in other side- without ip address.

Not to open another topic, still VLAN related.

I have this conf. on hAP AC2, connected to 260GSP, where i will connect more APs. (260GSP has VLAN 20 and 101 configured and all ports are tagged with both)
Every time i plug in eth cable from router to switch on ether5, winbox disconnects, cannot reconnect until i unplug ether5. I can still see the hAP in winbox, but it will refuse to connect (unable to connect).
If i disable "vlan20_interno", it's ok, and the winbox stays connected.

What else do you have in your switch? - If its "clean" dissable rstp on your bridge. It seems like you somehow dissable port, or got a loop.