It looks like you removed VLAN 89 from your config. If you add that back in and change your interfaces to look like this your config should start working as you intended.   You had your irb.0 under the "default" VLAN which is why you had to add the "default" VLAN to your interfaces to get DHCP to work.   Once you add the WirelessDMZ VLAN to the vlan members list on your trunk interfaces it will begin to look for that tag at the interface. You were really close the first time, but the default switch config might have led you astray a little.   https://pastebin.com/2SZnKSyC ... View more

@PhilipDAth and @dalmiroy2k You cannot see the headers on the image but the Allowed VLANs field has the "all" in it on the MX65. ... View more

or you could test moving your l3-interface from your "default" vlan to your "Wireless_DMZ" vlan. that would be the fastest test. ... View more

you could try changing the ae0.0 to this and see if it works: set interfaces ae0 native-vlan-id 89 set interfaces ae0 aggregated-ether-options lacp active set interfaces ae0 unit 0 family ethernet-switching interface-mode trunk set interfaces ae0 unit 0 family ethernet-switching vlan members all   but your irb interface is in a different VLAN than your firewall. I might need some more info regarding your desired topology but try this.   VLAN 1 (default) is used for management traffic between all of your network devices. Firewall, Switches and Access Points. Use VLAN tags to allow traffic to flow between your wireless/wired clients. Use firewall rules to restrict clients access to management network x.x.88.0/24   Lastly, how did you get your MX65W to connect via LACP? ... View more