Hi @HumanityFirst,

you define a trunk port by assigning a port membership in two or more VLANs and set it to »tagged«. That's all. Access ports are always »untagged« ports, which are member of exactly one VLAN. In this case, the Port VLAN ID (PVID) equals the VLAN's ID.

There are special cases which break this rule (e.g. for Asymmetric VLANs), but let's ignore this for the sake of simplicity.

So, you need to set up 3 networks on your OPNsense router and assign those VLANs: 107 for IoT, 77 for OtherGroup and 2 (or whatever) for the regular LAN, let's call it »mgmt VLAN«. Next, you add ports 1, 3-5 of the T1500G-10MPS as tagged port to all three VLANs 2, 77 and 107. PVID doesn't matter, but you could set it to VID 2.

Port 2 for OC200 must be untagged and should be in mgmt VLAN, thus you add port 2 of the switch as an untagged member of VLAN 2 only.

Also remember to remove all ports 1-5 from the Default VLAN 1.

You now can choose to either set the »Management VLAN« setting in OC200 to 2 (it will only set the mgmt VLAN in EAPs, but not in OC200 itself) or to have the switch tag untagged mgmt traffic from the EAP with VID 2.

I prefer to set the mgmt VLAN explicitly in OC200. If you do so, too, for adoption of an EAP you will have to temporarily set the switch port the EAP is connected to as an untagged port of VLAN 2, so the OC200 gets initial traffic from the EAP. The OC200 then configures the EAP to use VLAN ID 2 for mgmt, thus you need to change the port back to tagged in order to complete the adoption.

Hope this helps. For more details, see this HowTo.