Hi guys,

I've put the following together based on the little knowledge I have of networking (it was a few years ago so I've forgotten a fair bit!), so keen to see if it holds water in principle.

Essentially, I want a primary LAN for trusted devices, with the two AP's on a single SSID (effectively zero hand-off or whatever they're calling it these days).  This will be for devices that I administrate, so I know are patched etc.  I'll apply a moderate degree of firewall restriction, but devices on this LAN will have pretty much unrestricted access to the internet and other devices on their subnet (a printer, and maybe a NAS down the line).

The VLAN is for higher-risk devices - family, friends etc, and IoT-like devices, which could be unpatched/have weird connectivity requirements.  In other words I'm trying to achieve protection for clients on the primary LAN by reducing/removing the ability for insecure devices to ingress should they be compromised.

If this all looks ok, I'll ask some more specific questions!!