Hi

I want to change the guest wifi setup on an AP800.

At the moment, a 2920 is providing a second LAN on port 2. I've got this connected to the LAN-B port on the AP800, and set the guest wifi to work with that LAN. The problem with this setup is that someone could switch the patch cables and connect the guest wifi to the corporate LAN. Admittedly, the AP is PoE and the power is only present on the corporate LAN side so in fact, that wouldn't work - but with a PSU it would.

What I thought I could do is revert to a single LAN connection to the AP and use VLAN tagging. However, this doesn't seem to work. I don't know anything about VLANs really so perhaps I've misunderstood the principle.

I'll post some network diagrams of the setups I've tried - but am I missing something? Is this even theoretically possible?

Here's the (extremely simple) layout I was hoping to achieve:

1 WAN router, 1 AP, 1 switch, two wifi networks with one of them a guest network that can access the internet but not any machines on the corporate network.

IIRC the 2920 doesn't support VLAN .1Q tagging.
You need a 2830, 2860 2960 or 3900.

You could then set up multi subnets on each interface.