This article did the trick: https://www.thegeekpub.com/5191/use-airport-extreme-guest-network-bridge-mode/. If happen to have an unmanaged “smart” switch (such as the NETGEAR GS108) between your Airport Extreme and your firewall, you should only need to config the VLAN on the firewall and your unmanaged “smart” switch should pass those frames with no problem.