@Fathi_B.N. 

I have 6 EAP225(EU) v3.0 (Firmware Version:5.0.8 Build 20220118 Rel. 54520) and 1 OC200 (Version 5.1.7  1.15.2 Build 20220323 Rel.60717 ) connected to a TL-SG2428P v4.0 (Firmware Version: 4.0.1 Build 20211105 Rel.57589). Connection to the internet is guaranteed by an open source router/firewall (don't have a TP-Link router).

  @d0ugmac1 I already have a firewall/router and can't justify the acquisition of another router. What i am looking for is to put omada's first interface (poe) on admin vlan and have the portal listening on the other interface, which i want to put on the guest vlan. This should be easily achievable, but there's no such config option on the cloud console. Tutorial, videos, documentation,don't even mention the second interface: what is it for ? How to configure/use it ?

  @d0ugmac1 

Thank you. So, from what i have understood the two ports weren't meant to have an admin interface on one and a public interface on the other port. I don't want the oc200 admin interface to be publicly accessible to gust visitors.

  @Fathi_B.N.

Hello,

to the question if someone need omada-router:
if the hotspot is only used in the WLAN, it is sufficient for the OC controller. If LAN connections are also to be operated with hotspot, an Omada router is required.

Isolation of the controller access:
Since the controller and the hotspot manager are on the same IP, but the hotspot manager has to be reached by portal-users for authentication, access to the controller-Section of OC can only be blocked by using an ACL. As said bevore this can't be done with the use of Port 2 of Controller.
In the Omada-menu "Profiles" - "Groups" you have to ad the following "ip-port-group":
IP of your controller as subnet x.x.x.x/32
and port 443. (with /32 and port 443 only controller-section of omada gets blocked)
Than you create a switch ACL which blocks this IP group.( source: guest-(V)lan, destination: ip-group from obove)
So clients can reach the hotspot section of the OC, but not the controller section.

Remember to put the deny-rule before the hotspot's permit-rule, otherwise it won't take effect.

(If someone does not have omada-aware switch, they can try if the ACL works as EAP-ACL instead of Switch-ACL)
Hope that helps

  @nutzich

switch is TL-SG2428P v4.0 (4.0.1) and access points are all EAP225(EU) v3.0 (5.0.8). Everything is TP-Link except the firewall. OC-200, SG2428P and EAP225 all get their ips from firewall's dhcp server. Firewall has interfaces in all the different vlans.

Only two ssids have captive portal enabled, Guest ssid  has a simple accept terms login with advertisement and VIP ssid authenticates against an external cloud radius server.

Other ssid are hidden, with no authentication, no captive portal but traffic is intercepted by firewall's simple captive portal.

I have setup a firewall exception rule to allow access from Guest and VIP ssids to oc-200 ip/32 in the lan vlan.

I wished i could setup the captive portal ip in the Guest vlan, which is accessible to all vlans and don't allow anyone to know my lan addressing nor access a signle ip of it , that's why i asked about the second ethernet interface.