XG230 and AP15C multiple SSID's as VLAN's

Question

Greetings Sophos Community - 
 We just migrated from PfSense to an XG230. So far all is well and I really enjoy the product. I am trying to change our existing WLAN solution to AP15's and am unable to make it work. Can someone point me in the right direction? I have searched the forums and havent found a solution to my configuration. 
 
 The setup: 
 
 XG230 (16.01.2) 
 Dell PowerConnect 6248 switches (5 VLAN's - 10 - management VLAN, 11, 31 - Guest Wifi, 32 - Staff Wifi, 33 - users) 
 (2) AP15c 
 
 The ideal configuration: 
 3 SSID's each connected to their own VLAN (31, 32, 33) with AP native VLAN 10. DHCP would be handled by my Windows 2008 AD Servers (scopes already created for each VLAN). 
 I can connect the AP's to my switches with the switches in ACCESS mode (PVID 10) and the AP's appear in XG and also in the DHCP server. As soon as I turn on VLAN tagging on the AP's and set the switch to trunk all VLAN's to the switchport, the AP's appear inactive and nothing works. I have also tried changing the switchport mode to GENERAL with PVID of 10 and ADMIT ALL without turning on VLAN tagging and the AP's appear as INACTIVE. It seems like as soon as I change the switchport to anything but an ACCESS port, they AP's dont connect to the XG. 
 I have verified that VLAN routing works so I know that works. 
 Am i missing something?

lferrara · Answer

MBA, 
 AFAIK AP uses the VLAN 1 for the physical port (and cannot be changed it at the moment) and then you can bridge to VLAN where the clients will belong to. 
 Here you can find some useful info about the Wireless methods: 
 http://docs.sophos.com/nsg/sophos-firewall/v16050/Help/en-us/webhelp/onlinehelp/index.html#page/onlinehelp%2FWPNetworkEdit.html%23 
 For each VLAN, create a DHCP relay under Network > DHCP

MarkusSchlüter · Answer

Hi there, 
 
 after a hell of work (at the end of each year at our company) I am back and I can tell you the necessary steps to make this work: 
 - connect your AP successfully to your firewall 
 - enable VLAN tagging and set VLAN ID (not 1) 
 - after this AP restarts with new VLAN setting 
 - change VLAN tagging at firewall (setup VLAN "interface") / switch port where AP connected 
 - after a while AP shows up again (active) 
 - create additional VLAN "interfaces" and bridge SSIDs to VLANs 
 
 Send me a PM if you need a more thorough guide for this :-)