@Nirt 

You should replace your router with the Deco or use different vlans between wired and wireless networks in your existing router if you want to achieve proper isolation. 

Isolation is performed in the Deco, not outside of of it. Everything connected to or after the WAN port is considered as "the internet" for the Deco. 

@Glassman1976 

I can't replace the router, it used as a modem only.

If I change my Network topology to - Router -> Deco -> Switch -> PC, should it work?

@Arctech 

Howdy, I'd also like to request this feature - it's a pretty standard feature (for many years) for access points to automatically tag guest wifi clients with a vlan ID before passing out the ethernet ports.

I use my Deco M9 V2 in AP mode, as I have a Cisco device for a router/firewall. The cisco device (and the switches) trunk the appropriate VLANs to the APs.

Therefore, I'm raising a feature request to enable VLAN Tagging of guest wifi traffic when in AP mode.

@Kevin_Z

Being able to separate guests from residents does seem fundamental to mesh, and my V2s with latest firmware seems to support it. Being able to identify known/friend from unknown/presumed foe in the connected devices is also a fundamental. The web shows some information but not really enough to be useful in managing this aspect of security.

But first, I have rather more basic problems with  bandwidth to fix.

Is this still the case with the v2 hardware?  In AP mode, does it not actually isolate the guest SSID?  It actually ISN'T that hard inside the system to do this.  Routing rules and a separate IP space for the guest network can do this quite easily.

I am in a pre-sales research mode for a system to put into a new vacation rental home and thought this system might overcome some of the issues I have with Eero.  But if you can't do multiple, isolated SSIDs, it absolutely won't and I'll look at other options.

Thanks!

@TP-Link_Deco 

Are you going to isolate with separate VLANs? IF you're in AP mode, its generally as you have a separate router.