@mariog Thanks for the link. I'll keep an eye on this.

Ok, so the final update, I have everything fixed now (at least till now)☺

So the final trick is to set my switch to tag port 5-8 which connect to my 4 APs

apparently the tp-link APs will receice packages on it's selected wirelss VLAN + anything that's untagged (without vlan header)

after change my switch to tag vlan1 on port 5-8 it ensures all the vlan1 tag won't be removed when outbound the port, which fixes the RA flood issue.

Thanks everyone for the help