I've had a search but couldn't find the answer, and unfortunately I don't have any kit to test with, so perhaps someone who has done it can help?

I have an application where a 2820N at a remote site connects to HQ using an IPSec VPN for the LAN PC to access HQ resources. They wish to implement a "guest" wireless that does not have access to the LAN or the VPN - is this possible, and how?

I understand that I can isolate WLAN from LAN in the later firmwares.

With the newest firmwares, there's an option to isolate an SSID from VPNs as well, just next to the LAN option, that should work for what you're doing

Thanks for the info.