bohemus wrote

I'm not sure how to properly set up the VLAN tagging so that a Cox Homelife Security system router that is connected to one of the far switches resides on the 20 VLAN.

Create a 802.1Q-based VLAN 20 and add the system router and the Unifi USG to that VLAN. Since the USG is sending out tagged packets, check the Tagged button on the TL-SG108E's port. Since the TL-SG108E is a L2-device, you need to set up routes for the 192.168.2.1/24 network on your upstream router and also tag it's packets in order to transmit two separate VLANs over one physical connection. Generally, it's no good idea to have untagged and tagged traffic at the same time (except you use port tagging and a second connection from your upstream router to the TL-SG108E). Note that the TL-SG108E internally handles every untagged packet as a VLAN 1 packet even if you won't see this tag outside the switch. I would set up two VLANs (the default VLAN 1 and 20 for the guest network). Then you could use tagged packets 1 and 20 to your CHS system router, which needs to separate them into the two subnets.