@Morayf 

It can be done - you need to enable port isolation and rSTP on the switch ports the links connect to.  Only on the latest 1.3.0 beta for the ER8411 can you remove the default vlan from its ports meaning you can specify exactly only those vlans you want on its ports, but each port has to have a native untagged vlan that you would have to deal with at the other end in the switch profile.

However

I seriously dont recommend it!

The ER8411 doesnt have any kind of stp at all, and in my experimenting with this if you get even a brief loop (say when a downstream switch reboots and doesnt quite bring up all ports in the correctly configured state even for a moment), the router gives up, locks up, goes "disconnected" and all connectivity is lost.

One method that does work is to have a vlan filtering switch middle manning this, which i have done with a SG108E before - have all vlans on all ports on the ER8411, and on the SG108E you can actually specify tagged only ports, so it can "filter" whats coming out the ER8411 (eg, a tagged only link for certain vlans to an 8411 port) and on its output ports you can specify anything you want even tagged only - but you HAVE to disable loop detection otherwise even this will just start blocking ports.

The ultimate solution would be letting us configure tagged only ports on the routers in omada control - which you can do in standalone - this has been requested and there is a lengthy thread here, but they have clearly stated this is not going to happen for whatever reason

  @Morayf 

Yes, you can achieve what you're aiming for by assigning specific VLANs to the extra ports on the ER8411. Since the gateway allows port-based VLANs, you can use those extra links to separate traffic for different networks.

To avoid loops, setting the correct PVID on the core switch ports is the right approach. This ensures that only VLAN-specific traffic flows through each link. While the ER8411 doesn’t support LAG, using VLAN isolation and port-based assignment should work as a workaround.

Your use case for mirroring and packet tracing makes sense, and this setup gives you more flexibility in monitoring specific networks without overcomplicating things. It could also help in gigabit environments by distributing traffic more efficiently across multiple gateway links.

Just be mindful of STP (Spanning Tree Protocol) to prevent any unexpected loops, especially if there are redundant paths in your network. Hope this helps!