Hi @Aspage,

inside a managed switch there is no untagged traffic at all. If you set a port to untagged, you have to set the Port VLAN ID (PVID), so the switch can assign untagged traffic arriving on this port to the VLAN the port is a member of. Thus, access ports (those are ports to which VLAN-unaware devices are connected) must be in exactly one VLAN, whose ID equals the PVID.

Technically, an access port (untagged) can be in two or more VLANs for special setups such as asymmetric VLANs (a policy), but nevertheless untagged traffic will be directed to the VLAN designated by the PVID of the corresponding port.

What do you want achieve by putting the printer in a separate VLAN? Just learning VLANs or do you have a specific goal?

If you just want to learn about VLANs, you would need some more devices to separate them (e.g. two PCs, one sharing the virtual network with the Internet router only and one sharing the virtual network which also hosts the printer).

Note also that VLANs usually require own networks. VLANs are helpful if you have two networks (imagine two routers, two switches, two PC groups) and you would like to use only one router or one switch to carry traffic for both networks to save cables and expenses as well as to simplify management.

Unless you have separate networks or at least separate groups of isolated devices using the same network, VLANs are mostly useless.

Aspage wrote

Your explanation is very clear, although I'm a bit confused why I would need to set a PVID, if I already set an untagged VLAN for a port. But if that's what it takes, I'll manage, of course.

You need to set the Port VLAN ID (PVID) because inside a switch there is no untagged traffic at all. Thus, a port's »untagged« or »tagged« membership in a VLAN tells the switch whether the tag has to be removed or to be retained in frames on egress, while the PVID tells the switch which VLAN ID should be used to tag frames on ingress.

What I'm not clear on yet, is how to get a DHCP request from the same server (Windows 2016 on VLAN1) if my wifi-guest-network is on VLAN 10 (for instance). What are the setup steps to take for this?

 

Using the same network (broadcast domain) in different VLANs would require an asymmetric VLAN setup. While this can be done with switches, it is not possible to do so with VLAN-tagged SSIDs since the SSIDs cannot be member of two or more VLANs. To use VLAN-tagged SSIDs you would require two networks and I'm not sure whether Windows supports this (Linux does so).

I suggest to first read this HowTo for setting up a guest network and then to check whether Windows lets you create two networks as described (for Linux) in this HowTo. If it does, just follow the steps in the HowTo in method 2), else consider to use method 1) without VLAN-tagged SSIDs.