In a typical school network with distributed switches across departments, VLAN implementation requires careful planning. Your current setup with a central switch routing all traffic is ideal for implementing VLAN separation between wired and wireless networks.

// Example Cisco switch configuration for reference
interface GigabitEthernet1/0/1
 description Department AP Connection
 switchport mode access
 switchport access vlan 2
!
interface GigabitEthernet1/0/48
 description Uplink to Central Switch
 switchport mode trunk
 switchport trunk allowed vlan 1,2

Your understanding of VLAN tagging is mostly correct, but let's clarify:

• Regular wired ports: UNTAGGED VLAN 1 (default VLAN)
• WiFi AP ports: UNTAGGED VLAN 2 (AP should tag client traffic)
• Uplink ports: TAGGED VLAN 1 and 2 (trunk ports)

Instead of using separate NICs, consider VLAN sub-interfaces on your Untangle firewall:

// Example Linux network configuration
auto eth0.1
iface eth0.1 inet static
    address 192.168.1.1
    netmask 255.255.255.0
    vlan-raw-device eth0

auto eth0.2
iface eth0.2 inet static
    address 192.168.2.1
    netmask 255.255.255.0
    vlan-raw-device eth0

Configure your access points to:

1. Use VLAN 2 as native VLAN on management interface
2. Tag all client traffic with VLAN 2
3. Disable VLAN trunking if not needed

Implement these SNMP OIDs for VLAN monitoring:

1.3.6.1.2.1.17.7.1.4.3.1.1 - vlanStatistics
1.3.6.1.2.1.17.7.1.4.3.1.2 - vlanUnknownProtoFrames
1.3.6.1.2.1.17.7.1.4.3.1.4 - vlanDiscards

In this school network scenario, we have multiple departmental switches connecting to a central switch that provides access to servers and internet connectivity. The requirement is to deploy WiFi access points (APs) across different departments while maintaining traffic separation through VLANs and routing all wireless traffic through an Untangle firewall for captive portal authentication.

The proposed VLAN configuration follows these principles:

• Default VLAN 1 for wired infrastructure (untagged)
• VLAN 2 dedicated for WiFi traffic (untagged at AP ports)
• Tagged trunk links between switches carrying both VLANs
• Separate physical interfaces on the firewall for each VLAN

Here's how to configure a typical managed switch (using Cisco-like syntax):

# Configure VLANs
vlan 1
 name LAN_NETWORK
vlan 2
 name WIFI_NETWORK

# Configure access ports for APs
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 2
 description WIFI_AP_PORT

# Configure trunk ports between switches
interface GigabitEthernet1/0/24
 switchport mode trunk
 switchport trunk allowed vlan 1,2
 description UPLINK_TO_CORE_SWITCH

For the firewall configuration, you'll need to:

1. Assign physical interfaces to respective VLANs
2. Configure routing between VLANs if needed
3. Set up captive portal on the WiFi VLAN interface

When implementing this setup, consider these potential issues:

For more granular control, you can implement 802.1X authentication with dynamic VLAN assignment. Here's a basic RADIUS configuration example:

# FreeRADIUS configuration snippet
DEFAULT Auth-Type = System
    Fall-Through = 1

DEFAULT Service-Type == Framed-User
    Tunnel-Type = VLAN,
    Tunnel-Medium-Type = IEEE-802,
    Tunnel-Private-Group-Id = 2

Implement these monitoring practices:

• SNMP monitoring for VLAN traffic statistics
• Regular audits of port configurations
• Performance baselining for firewall throughput

Remember to document all VLAN assignments and maintain consistent naming conventions across all network devices for easier troubleshooting.