when I try to setup our devices this way, it doesn't allows me; I can use basic AP Mode with WPA2-Enterprise, and I can use Multi-SSID mode with WPA2-PSK and VLAN tagging, but when I select Multi-SSID the device doesn't offer me WPA2-Enterprise, only WPA2-PSK (or no security at all).

That's how WA901ND should work. If you have to use WPA2-Enterprise in multi-SSID mode, it doesn't meet your requirement.

Is this a hardware limitation?

I came across this forum when doing a google search for "TP-LINK WA901ND Multi SSID no Enterprise" and this is true. I am running the latest firmware as of February 2015.

I am the vice president of an IT consulting company and a customer of ours bought several of these for their network right before we came in. The customer asked if these would be sufficient to do what we wanted to do from a security standpoint. After doing some research, the device looked like it was going to work (the information on the box and web site says it supports WPA2-Enterprise - no mention about what mode to put it in or "fine print").

When we setup the WAPs initially, we used one VLAN to manage the device, one VLAN for the guest wireless network, and one VLAN for the business wireless network. Both used WPA2-AES. We had plans to move the business network to WPA2-Enterprise using certificates issued by the domain controller.

So, now that we are implementing, we billed the customer the hours to build the certificate server and NPS servers, then we go to config the WAPs and behold! - the WPA2-Enterprise option is not available when doing "Multi-SSID". This is very misleading, as the help text on the side talks about WPA2-Enterprise and what to do to configure it while in "MULTI-SSID" mode.

Very disappointing - it makes us look bad as a consultant and I should have known better not to recommend a TP-LINK product. We wont be recommending these devices to anyone, and we will recommend our customer get rid of these at a loss. Too bad we cant RMA something based off falsely labeling the box. It is not worth the time to load DD-WRT on the devices - by the time the the customer gets billed for our time to load DD-WRT (and to support it),the customer could be purchasing something like Merakis or Unifis.

To TP-LINK's credit, these devices have been very stable and we haven't had any problems with them from a performance standpoint. The only other complaint is when you update the firmware, it will wipe the config. This makes it a big problem when managing across routed vlans, and also the DHCP server on the device turns on by default.

IF you go to the website, and get the Manual:

On Page 41 says Multi-SSID supports WPA2-Enterprise, and it even has a screen shot. I am very upset they have mislead us on this product.