JensKofoed wrote

How should the switch be configured to allow tagged packets from the access point to enter at port 2 and exits at port 1, and the replay going back

Just enable 802.1Q VLAN mode, add port 1 and 2 of the switch to VLANs 1, 2 and 3 and mark them tagged.

Yes, you're right. I was under impression that the web UI of TL-SG108E is a subset of the web UI of other switches such as the TL-SG2008 for example, which lets one indeed select VLAN 1 (the "default" VLAN) to modify ports from untagged to tagged. But with TL-SG108E it is not possible.

As discussed in another thread already, IMHO it's a very bad idea from TP-Link to use VID=1 for untagged packets. As I understand the 802.1Q standard, untagged packets should have VID=0 (or more precisely: no tag at all), b/c that's the "reserved" VID to use as PVID for untagged ports/traffic.

Not being able to use VID=1 on TL-SG108E for own, separate VLANs or at least not being able to delete ports from it or make them tagged ports creates lot of problems with existing VLAN setups and also is not consistent with the possibility to use VID=1 on WiFi APs.

I have already filed a bug report last year to the German support, but did not get a positive answer about possibly changing the default VLAN policy from TP-Link engineering. Maybe we should open a new ticket about this issue. I did so already today.