@Morgans 

Is the switch port that the EAP is connected tagged with the default lan?  Are your mobile trusted devices getting the default subnet (same subnet as router) when they connect?

@1207 

Yes the native lan is present on the switch port, I have confirmed this by connecting a wired device to the port for testing

the devices I connected to the trusted wireless network did not get an IP address on the correct range, it was a different range to any of my defined ranges

@Morgans 

Are the trusted wireless devices getting an IP address that starts with 169?  This would mean the switch is not providing an IP address. You can try to set the EAPs switch port to the Lan "ALL" to see if it works. 

@1207 

it's interesting I had to break down the setup lasts night and reconnected it today and had the same issue.

I removed the vlan 1 tag from the trunk to the eap, just using thenative 'lan' plus vlan 20, 30 and had the same issue on lan wireless network but after trying a different wireless network and returning to the lan one it worked.

I had the lack of connection return 3-4 times during my setup work but unfortunately didn't capture the dhcp provisioned ip.

your suggested range doesn't ring a bell but if it happens again I'll capture it.

I could obviously be fat fingers on my part but the fact of doing nothing but drop the wifi connection and renewing it on my test devices would resolve it makes me question that