Hello.
I came up with an idea to keep all iot devices in a separate vlan.
For these purposes, I created a separate access point (not Mikrotik, IP-COM Access Point, and configured it as follows https://i.imgur.com/cMkO3Oh.png)
The Access Point is connected to the managed switch TL-SG108E, but VLANs are not configured in it.https://i.imgur.com/tMHalJz.png
TL-SG108E, in turn, is already connected to Mikrotik, on which a bridge for Vlan is configured https://i.imgur.com/ytTGFJ8.png
And it all works. Although it seems to me that it shouldn’t.
I thought that the vlan tag is added to the packet at the exit from the device (AP), and if the packet passes through a device in which VLAN_ID = 1 on all ports, then, accordingly, the label in the packet should change its value to 1, and bridge.2 should not see label 1002 coming out of the AP. in practice, Mikrotik successfully sees the tag (after all, the devices fall into the correct brige and receive an address from the iot subnet).
1) Tell me why this works, although it shouldn’t?
2) (indirectly related to Mikrotik), but how to forward the port to the TL-SG108E if there are values ​​from 1-8 https://i.imgur.com/2DY76T1.png
My config - https://pastebin.com/qVqk4aBW