The way to configure VLANs in OC200 is to set a management VLAN for administrative access to the controller and to use SSIDs with the VLAN enabled for the specific network the SSID is attached to. I would recommend to not mix tagged and untagged traffic over a trunk connection to the OC200, albeit it might be possible technically (didn't test this, I always use only tagged frames if VLANs are defined).

Management VLAN:

VLAN-aware wireless subnets:

OC200 network settings:

RSHCH wrote

In consequence this means there is no way to configure separate vlan id's or ip-adresses for each of the ethernet ports - right? (bridge?)

Yes, there is no way to set different VLAN IDs or IP addresses for the two OC200 interfaces.

Update: I made some more tests; it seems that the Management VLAN setting does have an effect only on EAP interfaces, but not on the OC200 interface.

May I ask why you would want to use two different VLAN IDs/IPs for the interfaces? For what purpose?

RSHCH wrote

You wrote the management VLAN is only used on the EAPs, but not on the controller. but how should the communication between controller and EAPs work in this case?

Communication between controller and EAPs is on layer 3, does not depend solely on VLANs.

There should be connection between a tagged VLAN on the EAPs and an untagged on the controller...

Yes. I usually place the controller in an own mgmt VLAN and feed him traffic from mgmt VLAN via an untagged port. EAPs are connected to the trunk anyway and each of the EAP trunk ports needs to be a member of the mgmt VLAN, too.

Setup using a managed switch

Using a managed switch I set up as follows:

1. EAPs are connected to the switch and are members of mgmt VLAN (say, VID 10), local net (VID 20) and guest net (VID 30). Switch port is tagged.
2. OC200 is connected to the switch and is member of mgmt VLAN 10, port untagged.
3. Switch needs interfaces for VLANs 20 and 30 for inter-VLAN routing, routes allow local / guest users to access the portal on OC200 in VLAN 10 (ACLs prevent traffic to other devices in VLAN 10).
4. Internet router needs to have at least two subnets for VLANs 20 and 30, allows Internet access over the WAN for local and guest users.

In general I try to avoid a Default VLAN (= native VLAN for untagged traffic), but another possible solution (see this FAQ here) would be to switch untagged traffic from EAPs arriving on the trunk port (no mgmt VLAN defined) and OC200 over a switch to the mgmt VLAN using membership of their ports in primary VLAN 10 (PVID 10).

Setup on a Linux router

Alternatively this is how I set up using a Linux router (OpenWRT-based):

1. EAPs are connected to three subnets mgmt (VLAN 10, interface ethX.10 tagged), local net (VLAN 20, ethX.20 tagged) and guest net (VLAN 30, ethX.30 tagged). IPs of EAPs are from local net.
2. OC200 is connected to subnet mgmt only (interface ethX.10 untagged). IP is from mgmt net.
3. Linux firewall default policy is to deny inter-zone traffic. FW allows TCP traffic from EAPs to ports 29811, 29812, 29813 and UDP traffic to port 29810 of OC200.
4. For portal access, FW allows HTTP from local/guest subnet to OC200.

Note that we use our own Captive Portal, so local/client access to OC200 portal isn't needed in our installations, thus I don't need to set up step 3 (switch setup) resp. step 4 (Linux setup) at all, but nevertheless I did test it with a Linux setup.

Hope this helps.