TKits wrote

The management Website ist accessible over all other VLAN-ip-Adr. why not the Auth-page ??

See this recipe: you would us static routes: http://forum.tp-link.com/showthread.php?99025-How-to-configure-Multiple-SSIDs-with-Multiple-VLANs-on-CAP-amp-AC-products

TKits wrote

to R1D2 : thx for your hint, but if you have read that Guide you know thats a enormous effort and i hope there is a simple Solution,
probably the programmers have to do something. It could not be so diffcult to integrate a function to bind the auth-page to other ip-adresses.

The guide just shows one possible solution, but the principle is always the same. And no, "binding IPs to an auth page" is no acceptable solution, since authentication then could be easily circumvented by clients just having to change the IP to break into the network.

That's why every business-class solution uses VLANs for Multi-SSIDs / separation of subnets for different classes of users and this is the reason why programmers did implement it in this way on AC50/CAPs and also on EAPs, CPEs etc.

I still don't get your problem, sorry.

If there is a shared portal/auth service you have to access from all subnets (VLANs) you just create another VLAN for the auth service only.

In fact, I just did set up this scheme for a customer, but with our own captive portal, which in respect to portal/authentication pretty much works like the AC50 does. And yes, we have a private, isolated network, a transfer network for Internet access, an isolated management network and two networks bound to two SSIDs. I don't have to open the firewall of any VLAN for the portal except for the two VLANs connected with the EAP's SSIDs. The captive portal runs on a system which connects to the auth service over an isolated VLAN which is apart from private and management VLANs. There is absolutely no risk since the auth service is the only service which can be reached through its isolated VLAN.

In TP-Link's recipe you use VLANs, ACLs and Inter-VLAN routing for making the AC50 accessible for all CAPs. I still can't see why this should be a problem to give access to the AC50 only. Maybe you are to focused of running the AC50 in your main network? Our captive portal is VLAN-aware, so we don't need ACLs or Inter-VLAN routing (this does the CP automatically), but the principle is just the same. But I don't have an AC50 here to test with, we use EAPs and a dedicated router running the CP or alternatively the router and EAP software controller, both work with Multi-SSID and isolated VLANs pretty well.