@KS_Peer 

the ER605 does not  care, where the WAN signal comes from, you can setup whatever private network you want in front of the router. 

The only issue with that setup is, that the omada controller cannot "see" both networks at the same time (as far as I know because despite having two LAN ports only a single IP address is supported, correct me if Im wrong)

I have somewhat of a similar setup (just without that WiFi connection inbetween) and it works fine, but Im not using Omada controlled stuff there and there is no connection between both networks (because ER605 will work as NAT firewall)

  @RobertMEF 

Dear Robert,

Thank you for your reply. If I can't see the network of ISP1 in Omada, that won't be a problem. However I would need to have location 1, location 2 and the event site in 1 network, because there will be CCTV on all locations that needs to connect to the controller at the event site.

My plan was to create 2 VLAN's: 

- VLAN10, all the devices and end devices at all sites are in VLAN10

- VLAN20, only 1 port of my Omada switch at location 1 is in this VLAN (connected to ISP1), and at the event site only 1 port of my Omada switch will be in this VLAN (which I patch to one of the WAN ports of the router.

Since I have used VLAN only once before, it's all pretty uncommon for me. Do you think this setup will work? Am I missing anything important?

Is it better to create the 2 VLAN's as suggested or is it also possible to create only 1 VLAN (VLAN20) and have all the other devices to work without VLAN?

Thank you for your help,

Kristof

  @KS_Peer 

when you need ISP failover or even load-balancing, that method wont work.

Because a VLAN is nothing more than a virtual network, with its own subnet and routing. So if everything is VLAN10, the ER605 will be nothing more than a switch and there is no connection to VLAN20, because the default-gateway is on Location 1 and therefore all devices are using the VLAN10 and not a single device will use the ER605 as a router. 

So in order to achieve your goal of failover/loadbalancing, you _have_ to cut the networks on Layer2, so the ER605 does routing to every location. Because of the stupid NAT table (which I hate TP-link for) you will lose access from Location 1 to Location 2 (so it is impossible to control the network from Location 1 with just a single OC200).

but as it looks like, you can manage multiple locations with the help of port forwarding:

https://community.tp-link.com/en/business/forum/topic/260074

so I would give that a shot