@RogerEC Check this:

@Intense I think it is totally OK, it is a brand new product that tplink releases.

@Fidibus Yes, EAP has its own network, its own SSID. But it acts the access point to extend the router's wifi signal.

@SuperSonicBiker It means there is some trouble in your VPN settings, because you can not even establish the tunnel. Check if you use IKEV1 or IKEV2, maybe it is the issue.

@ErwanA I think so, but here is a prerequisite, the clients don't need the Cloud to use.

@ErwanA In my opinion, you need to make sure the DHCP Server is working and can assign IP address to all devices, it will be OK. Check if all clients behind EAP can obtain the valid IP, if they can,...