Synology Guest WiFi (VLAN ID 1733, Synology mesh WiFi system) with Netgear GS752TPP Switch

Hallo Max,

Ja und nein.... 

The problem starts with Synology's incomplete documentation in the Router SRM 1.2 manual (no word on how the Guest VLAN is really working over a wired network!) and does top with the (in my opionon very odd if not simply awfuly wrong) information provided My guest network is not functioning properly when the mesh Wi-Fi system has been set up. What can I do? Yes, I have an idea what they tested ... simply extending ONLY the guest network to the access point in a "dumb" mode only.

Permitting both the AC2600AC and the MR2200AC in Access Point mode are operating

• normal network as VLAN 1, untagged, and 
• guest network as VLAN 1733, tagged, so
• the router and all access points are supporting the main and the guest network
• a direct network cable connection between the AC2600AC router and one MR2200AC in AP mode does make both the normal network as well as the guest network run on the both Wireless as expected, this does proof (most) of the above assumptions.

If not done already, create the VLAN 1733 as a 802.1q VLAN on the switch.

Case A. Each port connecting to the AC2600AC router and the MS2200AC access points must be configured like this:

1. VLAN 1, [U]ntagged, PVID 1 ... this makes the normal network running, and applies also to ports where you want to connect computers, printers, and whatever has access to the main network. The switch will send any untagged frames incoming to the VLAN 1 (this is what the PVID 1 is for), and send frames from the VLAN 1 out untagged to the connected device.
2. VLAN 1733, [T]agged.  ...this makes the guest network - which is a 802.1q tagged network - to send and receive VLAN 1733 tagged frames from/to the VLAN 1733.
3. Double check the port(s) are set to allow tagged and untagged (both) packets/frames.

Case B. In case you like to make a switch port assigned to the guest VLAN (and only then!) use this:

1. VLAN 1733, [U]ntagged, PVID 1733 ... this makes the normal network running, and applies also to ports where you want to connect computers, printers, and whatever has access to the main network. The switch will send any untagged frames incoming to the VLAN 1733 (this is what the PVID 1733 is for), and send frames from the VLAN 1733 out untagged to the connected device.
2. Allow only untagged packets/frames.

As simple as this.

In case you would consider heading to Netgear Insight managed wireless access points (and optionally switches), you create the VLAN 1733 on the switch, configure the ports as shown above, create one SSID for VLAN 1, and the Guest SSID for VLAN 1733. Same story as above...

In case you want to connect some consumer class APs supporting only one SSID and one VLAN only, use the configuration as in the case B above.

Viel Erfolg!

-Kurt