Been running with default LAN/WAN created by wizard during initial setup for a few years now. Have an OpenVPN interface as well which is working as expected.

LAN is VLAN4091 - 10.215.0.0/16 on LAGG0

Attempting to add VLAN 216 (10.216.0.0/16 on LAGG0)

Added the VLAN under Interfaces / VLANs with VLAN tag 216
Assigned VLAN 216 to Interface LAGG0
Configured the Interface with 10.216.0.1/16 and no gateway (block networks unchecked)
Configured Firewall rules on newly created interface allowing all protocols/source/destination/ports etc

Interfaces / Switch / Ports - I've set ETH3 and ETH8 Port VID 216
Interfaces / Switch / VLANs - I've set 3,8 as members of VLAN tag 216 (tag unchecked)

I'm able to ping the VLAN 216 Firewall Interface IP address 10.216.0.1 from existing LAN and VPN clients. I'm unable to ping a device connected to ETH3 with static 10.216.0.3. Devices connected to ETH3 and ETH8 are unable to get DHCP. With static IP address they are able to ping each other (10.216.0.3 and 10.216.0.222) but are unable to ping the gateway interface at 10.216.0.1, and unable to ping anything on WAN (no reply ping to 9.9.9.9).

I feel like I'm missing something with inter VLAN routing, the switch assignment, or some other very simple thing. I've worked with Fortigate/Sophos/Palo Alto firewalls in the past, and Cisco and Ubiquiti switches, so I have some familiarity with firewalls and switching, but been scratching my head on this one for days. Thanks for any help!