If you want to let 901ND gets IP address from VLAN20, you just need to make sure that untagged packets from 901ND could go to VLAN20. That would be fine. But there are no way to only allow VLAN20 could access web gui. The wireless clients all could access its web gui.

I have the same issue on the AP500 within Multi SSID Mode.
There is a feature needed whichs allows the admin to choose a VLAN for the management traffic instead of just sending it out untagged...

PS: I guess you can manage the AP from every SSID if the Client is connected wireless AND has an IP configured on the same subnet like the AP?

User "dottad" sent me a private message with a question regarding the above configuration (multi SSID and VLAN). But he has configured his account not to receive private messages, so I cannot reply. Here is my reply in the public thread, maybe he is reading it here :-)

Yes, I am using it with several VLANs for several SSID.

I have simply configured my switch port (Netgear prosafe line) into trunking mode with the VLAN-IDs I am using with my SSIDs. Additionally I have configured my switch to put all untagged ethernet packets coming from the TPlink into my management VLAN.

That works fine here...

Best regards

markus