You should have only 1 untagged VLAN per port. Otherwise the switch doesn't know which VLAN an incoming untagged frame belongs to. Also, the EAP tags the packets. So, at port 14 all VLANs including VLAN 1 should be tagged. Kind regards Martin

 I am back to give you all update on this. It took some time to acquire all the network gears needed to upgrade my Home Network to a 1Gbps throughput.

The problem I had back in January was that Wifi devices were failing to connect to the access point on any of the 3 SSIDs linked to the 3 Vlans I had created, and they were all returning the error message “Couldn’t get IP Address”. I suspected after some research that this was due to my Router not being Vlan aware.

Since then I have acquired 2 more EAP245 access points in addition to the EAP225-Outdoor access points I had. An Omada Hardware Controller OC200 as well as a Router TL-R605.

I now have an IoT Vlan created through the Omada controller in addition to the default Vlan 1. Also created are 2 SSID for wireless access, one for the default vlan and the other for the IoT Vlan. Devices connected to these different Vlans (wired & wireless) are now assigned correct IP addresses from the right Subnet i.e 192.168.0.x for the default Vlan and 192.168.20.x for the IoT Vlans.

Observation: I noticed that without the Omada Controller you cannot create Vlans with different IP Subnets as the router’s Web GUI has no menu for assigning different IP Subnets to the different Vlans! Quite strange or is it intentional to get users to buy the controller?

I have not been able to achieve Vlan isolation. I can ping devices in a different IP Subnet from devices in another Subnet. Does this imply that broadcast from one Vlan is being transmitted to devices on the other Vlan which defeats the purpose of setting up a Vlan to isolate network traffic and improve throughput? From research it seems I need to configure the Switch ACL to grant and deny permissions between the different Vlans. Unfortunately, my Easy Smart Switch  (TL-SG1016DE) isn’t Omada compatible and it’s built in Web GUI doesn’t seem to have a menu option for Switch ACL configuration? Has anyone been able to solve this problem?

@RonNaija I solved the  VLAN Isolation problem partially by configuring EAP ACL in OMADA, as my switch doesn't have ACL functions. Any wireless device connected to my IOT Vlan no longer has access (can't ping) to devices on other vlans. However this isolation is ineffective for wired connections through ethernet cable to any of the designated IOT port on the switch. Unless I change my switch to one with ACL features I would have to live with this partial solution/