panicos wrote

Now i can reach the TPLINK IP, but still cannot reach Cisco IP (which is on the same subnet).

This is another example of the never-ending story of TL-SG108E having a fixed Default VLAN 1. The question is, what happens with untagged Ethernet frames in the Default VLAN on egress? According to the switch's manual, any untagged Ethernet frames received by the switch over the trunk will be added the PVID of the trunk port (that's correct behavior in the sense of Cisco's native VLAN). Since PVID is 1 in your setup above, untagged frames will get assigned to VLAN 1.

But what happens on egress of such frames on the trunk port? Since ports 1 & 2 are set as untagged ports for VLAN 1, the VLAN tag should be removed, so the Cisco AP should see an untagged frame and handle it through its native VLAN. But since ports 1 & 2 are trunk ports, according to the manual the frame will be forwarded unchanged, i.e. the VLAN tag not removed on egress. I still couldn't figure out what really happens to VID1-tagged frames on egress over a trunk.

Long story short: I did give up to handle VLAN 1 in my network through TL-SG108Es (I have two of them and similar requirements to be able to handle trunked VLAN 1). While my appliance switch (a TL-SG2008) can be configured to handle VID1-tagged frames over a trunk, I was not able to set it on TL-SG108E. I opened several tickets with TP-Link asking for a firmware change to be able to handle VLAN 1 much like any other VLAN (as it is possible with TL-SG2008), but so far I only got a response that they won't change the Default VLAN on the Easy Smart Switches. So I'm actually considering to replace the TL-SG108Es by smart switches such as the Netgear GS 108E, which allows me to configure VLAN 1 just like any other VLAN.

If TP-Link insists to set a fixed Default VLAN for whatever reason, they should use a VLAN ID above 4090, but not VLAN 1.

Great that it works. However, if the switch indeed uses untagged Ethernet frames for the mgmt IP of the AP in VLAN 1 and the AP uses a default address of the router, this means that the AP's mgmt interface can be reached from each VLAN, right? So, the Default VLAN problem still remains, since every port is always a member of VLAN 1 (that was my point).