Help with discriminating wifi AP traffic please

Hi Fordem, Thanks for coming back to me so quickly. No, the firewall router is not a Netgear device. It was supplied by my ISP. It is a FireBrick 105 (now obsolete!) It has a fixed IP on WAN side with two ports connecting to two bonded ASDL lines. This is to give us bandwidth because we are out in the country and a long way from the exchange with only copper connection. There are three other ports and these are set up for three different subnets as described earlier in thread. The two subnets Office and Guests will both have one or two wifi access points and both access points have to be able to handle traffic for Office and Guests. With your help I am taking this one step at a time. If all goes well there is also one AP I have which is not vlan aware but which I would like to use for Guests only. This may not be possible given your earlier advice this has lower priority. On tagging, this is where my understanding is weak. I am assuming setting port 'T' will tag and 'U' will pass tagged frames but not change the tag. If I leave a port without either a T or U set, I understand that this effectively takes the port out of the vlan but am not sure I am correct. I tried with no vlan on router and 'U' on port 1 but couldn't get IP address. Based on experience so far I think I would prefer to set router and switch ports as 'T' tagged. On DHCP I would prefer to use firewall as DHCP server on all subnets. Regards, Budgie2