@jandico 

When I replaced my all in one router with a TP link setup 

I started by just connecting my directly connecting to my pc to the OC controller.

I ensured I had the FW's of the OC and ER605 in my case on my computer before this step.  I figured those should be in the lastest before I even try to get online

so I initialize the OC200 with only my computer attached,  flashed FW 

and then added I added a switch and ER605 ,     I adopted this basic setup.  .   So none of the new TP link stuff was never on the all in one routers network.

so the new network was not online at this moment

From my ISP I have a modem/router with multiple lan ports , my current all in one router was already behind this ISP provided one  (so double nat)

I just connected the Wan ported ensure the ER605 got an ip and I was online , internet stuff worked.  

After initial it when quite fast. really.  I then continued by adding more switches and AP's and updating FW's where needed. 

I created new SSID's etc.... and moved some devices mobile, wired , printers over.   my old router was still doing its thing.    I just moved more and more stuff over. 

and at the end I basically mimicked the SSID's of my all in one and just removed the All in one.   Then still some less used devices popped up.  and I kept moving them to the new SSID. 

now months later I still mimick 1 old SSID because there is simply 1 client I can't update the Wifi settings for :( 

@mehmeh 

Thank you I will try this instantly.

Is therre an option to migrate to the tp_link cloud at a later time or should I always stay standalone?

@jandico 

Cloud access does not have to be active from the start. 

When I bought this setup I did not have any intention to use any TP link provided cloud services.   I still have no intention to do that.   If I want remote access I will use VPN and then control my network from that solution.   

I started with not enabling the cloud account in the controller.  unfortunately you can't even poll for FW updates or know they are available with it

So early days I updated the FW's all manaully. 

but its was quite a hassle.   ( international or localize site didn't have the same Version etc... ) 

I have not attempted to ever logon remotely onto my setup even with cloud access enabled. 

however , lazyness took the better off me and now when I know there is a FW update I toggle the cloud access on and then immediately off again afterwards. 

I would love to have the option to make that destinction that you would only allow for 'passive' activities like requesting new FW with this cloud access 

and a extra toggle for 'active cloud activities' , updating config etc... so like a real 'opt in' to let the remote cloud change setttings.    its obvious the cloud remote interface should not be allowed to toggle that option  :-) since it would defeat the purpose :)

@jandico 

well I got curious ,  so as I said I have cloud access disabled at my side. 

and I logged on to the cloud platform of TP link and I see my controller in on there side (it was offline ) I suppose when I enable it at my end I could probably see or do alot more stuff .    That doesn't make me happy. 

But since there is no other possibility to check for FW updates , I will just be a very unhappy customer about the inability to probably opt in to only allow FW checks and nothing else.   so I guess when I toggle it , I'm at the mercy of the TP links security model to keep my network save.   :(  

@jandico  Hi,

I think you can use your existing network as a network source, make sure it has no IP conflicts with the ER7206, then you can connect the WAN port of the ER7206 to the front end network, then connect the switch, OC200 and AP to the ER7206, then go to the OC200 and adopt these devices. Like this: source--ER7206--Switch--OC200&AP. Make sure ER7206 can get the internet from the source and then switch,oc200,ap and the er7206 are all in one network segment.

@mehmeh 
Thanks Mehmeh, this was a great help as i understood double NAT should work and build the network similarly. I was able to get all required functions working and tested accordingly.

Learning I was confronted with (or I messed up) do not change the basic default network (192.168.0.0) after configuring all your other networks but start configuring your "basic/system" network in the initial step "Configure the router".

In this step I configured the required network as well as a fixed IP address on the WAN side to be able to find the new network and test firewall settings in a later stage. Second step i connected/wired all other devices including the attachment of WAN. Third step connect to OC200 and configure.

It took me long time to find how to de MAC binding function (why is it called configure fixed IP) and other way tp-link implemented/named network functions.

There is one ACL function a could not realize in the way I planned but I found a different less favorable work around. I plan to ask this in an other request in this community. I did not have time left as last weekend we changed the old network and went life with a full tested tp-link configuration. Sofar we did not have major issues. 

Thanks again for your swift response and guidance.

jandico