Clients on the VLAN 1 SSID cannot get an IP address when the AP’s management VLAN ID is tagged

Zyxel_JoyLee

For a Nebula-managed Zyxel AP, your issue is likely related to how the AP handles VLAN 1 when its Management VLAN ID is set tagged.

When the AP Management VLAN is configured as tagged, SSID traffic should also use tagged VLAN interfaces.

Recommended configuration

Setting	Configuration
AP Management VLAN	99 (Tagged)
SSID VLAN ID	1
Switch port VLAN 99	Tagged
Switch port VLAN 1	Check whether tagged traffic is accepted
DHCP server	VLAN 1 DHCP enabled

What should be checking:

1. NCC → Devices → Access points → Select AP → LAN IP: Confirm Management VLAN 99 is tagged.
2. NCC → Configure → Access points → SSID advanced settings: Confirm SSID VLAN ID is 1.
3. Switch port connected to AP: Verify whether VLAN 1 is configured as tagged or untagged.

If the Nebula AP sends wireless client traffic with an 802.1Q VLAN 1 tag, the switch port may not handle it as expected because VLAN 1 is configured as untagged.

4. Packet capture: Check whether the AP sends DHCP Discover packets with VLAN 1 tagged or untagged.

Reference:

https://community.zyxel.com/en/discussion/11984/change-management-vlan-id-on-wax610d-disrupts-ssid-in-vlan1

https://mysupport.zyxel.com/hc/en-us/articles/360003293420-Nebula-AP-Switch-Configure-a-non-default-Management-VLAN?utm_source=chatgpt.com