NWA90AX - VLAN for guest SSID (only) doesn't work

As per title, I have an existing router that supports VLAN I would like ultimately to disable its WiFi (as it goes up to AC only) and use the Zyxel only.

Now the issue being: the router does .q tagging and have the main WLAN on VLAN1 and the guest WLAN on VLAN 3. Extending the main SSID works ok e.g my mobile detects the SSID "v6" and can connect to it. Connecting to the guest SSID though, I do see the SSID v6 advertised but it fails the connection. This is not an authentication issue the mobile phone complains about not being able to obtain an IP address but the DHCP is certainly working on the main router as devices can connect to the old router just fine.

Any tip on where to look to troubleshoot this?

Thanks