Prosafe JGS524PE Strange UPnP only works when bypassing switch

I have a programmer background. I'm fairly tech savvy but networking is not my strong point. However, I have accomplished this goal with other hardware in the past. I asked this question to Mikrotik support and they said the router seems to be working fine, so it must be something else in my network. I'm wondering if it could be the switch. I am new to this forum and hoping someone here may be able to give advice.

home network setup.

• Arris SB8200 modem
• Mikrotik RB3011 router
  • Switch is plugged into ethernet port 10 on the router.
  • Modem is plugged into ethernet port 1 on the router 
• Netgear JGS524PE managed switch with latest firmware and default config

  • ~12 wired devices

    2 wired WAPs with ~ 20 clients connected to them.

Router setup

UPnP is enabled on the router
internal interface set to "bridge"
external interface set to ether1 (this is where my modem is plugged in).

DHCP is turned on and in IP -> DHCP Server -> leases I chose "make static" for my switch, and for the specific clients(4 in total) that will need UPnP.

Everything else has default config.

Issue

UPnP is NOT successful when connected like this:
ClientX -> Switch -> RB3011
Device does not show up in router under IP -> Firewall -> NAT 

However, UPnP IS successful if I plug the client into the router directly:
ClientX -> any available ethernet port on RB3011.
Switch still plugged into the router on ethernet 10, but client is bypassing switch completely

When I log into the router I can see the device under IP -> Firewall -> NAT

Then if I plug the device into the Switch:
ClientX -> Switch -> RB3011
It still shows up in IP -> Firewall -> NAT and UPnP is still working.

It seems as though I have to bypass the switch initially for the client to successfully negotiate UPnP. After that I can connected the device back to the switch and all is well.

I am not sure why the switch could be the culprit. There are no QoS options or VLANS enabled. It's brand new with the default config.
All devices have the latest firmware.

I'm wondering if there is some additional configuration I need to setup on the router or switch to work as expected.

It seems like I should not have to plug into the router directly for a client to negotiate UPnP.
Am I missing something? Is it possible to achieve this with this hardware?
Any help is GREATLY appreciated. I am not sure where else to look.