Yes, they should be able to reach anything on vlan 1. The packets from the staff wireless should come in untagged and since vlan 1 is untagged that is where those packets will stay. 2. Packets from Guest wireless will come in tagged on VLAN 11 and be able to access anything that in on VLAN 11, g16, you probably could leave g16 tagged in VLAN 11 if your firewall can read VLAN tags Your setup should work fine. Only VLAN 11 will have access to the dmz port on the firewall. 
Hi, I have a 2824 PowerConnect and two Ubiquiti UniFI APs each of which is wired into a port on the 2824.  The UniFi APs create wireless networks and share the configuration among all radios. These two APs are publishing two SSIDs, one protected wireless network for staff, another unprotected wireless network for guests. I have the ability to tag either wireless network as I want. I want to use a VLAN to push traffic through the Dell switch onto a DMZ port in our firewall.  My initial idea was to: 1. Tag the Guest wireless network with VLAN 11. 2. Leave the Staff wireless network un-tagged. 3. Set trunks on the two ports which terminate the APs to allow untagged and 11. 4. Add an additional port on the 2824 to membership in 11 only. 5. Wire the 11-only port to the DMZ port of my firewall.   Here are my questions: 1. Can a trunk port allow both un-tagged and ID packets? 2. If so, can I specify a port REJECT untagged packets? (I want to prevent untagged stuff from reaching the DMZ port on the firewall.) 3. Does anyone see a flaw in my set up? Thanks, m
Dell 2824 / Ubiquiti UniFI / Guest WIFI VLAN tag