@volfan 

Thanks so much for your response.  I have a related question that I probably should have asked in my initial post.  In addition to my main switch (TL-SG2016P) which is managed by the OC200 controller, I have a TL-SG108PE switch.  I understand that the OC200 cannot manage it, but I wonder if it will do what I need using the web interface.

My basic set up is ER605 Router <------> TL-SG2016P Switch (Main Switch) (OC200 connected to Main Switch) <---------> TL-SG108PE Switch (Switch B)

Two AP's (EAP615 and EAP610) are connected to Switch B.

I have three networks configured and running - Main Secure, IOT and Guest.

I would like the AP's to be available to all networks and would like to restrict traffic on certain ports on Switch B to the IOT network. 

I tried to accomplish this by tagging and untagging ports to the IOT vlan on Switch B - I tagged the AP ports and the port from the Main Switch and untagged the other ports.  But, the devices connected to the untagged ports still appear as clients on the main secure network.  Maybe the main switch is not configured properly to support this.

Can I do what I want with the SG108P?  Or, do i need another SG2016 managed by the controller?

Thanks for your help!

  @volfan Yes, what you're aiming for is absolutely doable. You can connect the additional TL-SG2016P switch downstream of the existing one and manage it from the OC200 controller. The controller should adopt the downstream switch, allowing you to assign specific VLANs to its ports. If you run into any hiccups along the way, feel free to ask for help.

  @Davidsk Thanks for taking time to respond.  As you can probably guess, I am a novice.  I had read and lot on this forum and appreciate the help.

In my second post on this thread, I raised a related, but different, question.  Basically, I am wondering if I can get where I want to go using a switch (TL-SG108P) that can't be managed by the OC200.  I provided more details in that post.  I would appreciate any input you may have there.

Thanks for your help!

  @volfan 

In this case, the TL-SG108P won't be directly manageable from the OC200 controller, but you can connect devices to it and have them communicate through the VLANs set up on your managed switches (like the TL-SG2016P).

To achieve VLAN segmentation for devices connected to the TL-SG108P, you'll want to ensure that the port on the managed switch to which the TL-SG108P is connected is configured appropriately. For example, you can set that port to a specific VLAN, and devices connected to the TL-SG108P will inherit that VLAN.

If you have specific VLAN requirements for devices connected to the TL-SG108P or encounter any issues during the setup, please provide more details, and I'll do my best to assist you.

  @Davidsk  Again, thank you. 

My crude attempt at a map is below. 

I am struggling to get the IOT ports on the unmanaged switch configured.  I have made a couple of attempts.  One of those caused the devices I wanted on IOT to be shown on the controller as connected on IOT, but other clients on the network couldn't see them.  In another attempt, the IOT devices didn't have internet.  I have tried to read carefully about tagging and untagging the ports, but must be doing something wrong.

How should the trunk port from the main switch to the unmanaged switch be configured?  As of now, it is set to all profiles.

I have some question as to whether what I would like to do with the EAP615 AP is possible.  Does the port out of the unmanaged switch need to be dedicated entirely to IOT vlan in order for the wired client to be on IOT?  I could connect the client at the end via wifi as an alternative and leave the AP available to all vlans.  Or, It wouldn't really be a problem to commit the AP to the IOT vlan as well.

Everything is working except getting the IOT clients connected to the unmanaged switch on IOT and getting the client connected to the EAP615 on IOT.

Thanks for your help!!!

  @volfan Posting again in an effort to ask my main question more simply.  Grateful for any advice . . .

I need help configuring two switches so that ports on the second switch are assigned to a particular vlan and have internet access.  The main switch is a TL SG-2016P managed by an OC200 controller.  Downstream is a TL-SG108PE "smart switch."   I want certain ports on the 108PE to be dedicated to an IOT vlan.

The only profiles on the main switch are those automatically set up when initially creating the vlans.  All of the ports on the main switch are set to "all" vlans which i understand makes those ports trunk ports.  Right?  Do, i need new/different profiles on the main switch to do this?

I used this article as a guide to configuring the 108PE smart switch ports:  https://www.tp-link.com/us/support/faq/788/ 

Assume I am interested in dedicating Port 4 of the 108PE to the IOT vlan.  Making those changes referenced in the article above to the 108PE and no changes to the upstream managed switch, the device on Port 4 does convert to IOT on the controller and gets a new IP address.  And, what puzzles me is that the whole 108PE switch gets a new IP address and shows up as connected to the IOT vlan.  And, I loose the internet connection.  I can only undo the changes by resetting that switch.

I am a newbie, but trying to learn.  I am guessing there is someting simple that needs to happen here, but I don't know what!

Any help appreciated.

  @Clive_A  Thanks.  I finally got things functioning about like I want.  But, after making changes to some ports on the TL-SG108PE switch, it resets itsself to the IOT vlan and acquires an IP address in the IOT vlan.  It is functioning like I want I think, but it seems like the switch should be on the default vlan.  After the switch moved to the IOT vlan, I tried to set a static ip for it in the controller.  The controller reports that the change succeded, but the ip address doesn't change.  Should I care whether the TL-SG108PE switch is on the defaule vlan #1 or IOT vlan 2?  If so, how do I change it?

Thanks!

  @volfan Well . . . update . . . the IP address did finally update with setting it to static in the controller.  I am curious, though, why does the controller still show the switch as being on the IOT network (vlan 2) when the IP address is on the default network (vlan 1)?

Also, in the settings on the TL-SG108PE switch, under the IP address setting menu, the DHCP Setting can be set to Enable or Disable.  It is presently enabled.  Is that correct, with another managed switch and router above it?

Thanks!