Ubiquity vs USGFlex700

So I have tried today many kinds of setup, but without desired outcome.

Main try was to create VLAN on ZyWALL - VLAN8 in my case, which I hav defined over interface ge8. The VLAN interface - vlan8 - was defined also as DHCP server with its own range - 192.168.8.x. The intent behind this was that I would define the corresponding Ubiquity SSID: ZsM_Internal via Ubiquity network Internal, which would be defined as pure VLAN-network - with the same VLAN ID as on ZyWALL interface ge8 - i.e. VLAN ID:8.

This did not worked.

It is quite maddening to me, that whatever I tried, anly the ZsM_Public worked, as this was defined as GUEST WiFi within Ubiquity. It seems to me that Ubiquity gives a **** about any setup over it. But perhaps it is my lack of knowledge, I do not know :-D

What I have done - at least - is the separation of those WiFi packekts by defining its own zone - LAN1 - within ZyWall:

All of these ZyWALL interfaces - ge6, ge7, ge8 - are governed by zone LAN1:

while interface:
ge6 - Ubizuity PPoE switch is plugged into respective physical port of ZyWALL
ge7 - DHCP pool of addresses 192.168.5.x for GUEST WiFi
ge8 - DHCP pool of addresses 192.168.8.x for Intranet WiFi

I have set also the Policy Control for LAN1 in very broad and general approach:

with the intent then to restrict WiFi usage by "Policy Control" just to Internet related services together with DHCP services (so I would not fool Ubiquity controller):

while I have defined Service Group "WiFi_allowed" like following:

But this did not worked at all - although I have got "Connected, Secured" when trying WiFi, no web page couldbe access.

So I have deactivated these "Policy Control" (as seen in the screenshot)

But even after deactivating it - so no restrictions are applied to the connection - no web page could be accessed.

1. WiFi SSIDs are visible, one can connect to it and one gets "Connected, Secured" status of WiFi connection, however, in reality, no website loads - perhaps the group does not include a must needful bunch of services to achive this
   OR
2. LAN1 zone is somehow not enough, although I have set it very much like LAN zone - as you could see I have excluded ZyWALL from both Policies:
   1. LAN_Outgoing
   2. LAN_to_Device

Thanks for any points, experiences with the similar challenges.

NoE

@PeterUK yes, you're right.

I have proceed with VLANs now, I have created two over ge6:

Both VLANs and ge6 interface are within zone LAN1:

The security policy of LAN1 is:

The restriction via Policy Route to access only Internet works niicely:

However the problem persists: only Guest WiFi defined over Default network profile within Ubiquity controller works.

Even the almost same setup for Internal WiFi which is in fact creating new Ubiquity network "ZsM_Internal" with the SAME setup except for the IP address range…..and it does not work. Perhaps the issue stems from something Ubiquity specific.

All components of Unify network are interconnected via Unify switches. One of these switches is wired directly into ZyWALL port ge6.
On ZyWALL's port ge6 DHCP server 192.168.4.x is defined which gives all Unify components IP from this range - this is behaving correctly.
I am defining the SSID within Unify network only. I have not defined them within ZyWALL - I suppose this feature of ZyWALL is for standalone APs.

I am thinking now about the way the packets from the two VLANs are routed and what is the GW for them.
The switch USW-Flex-mini supports VLANs, so there should not be a problem.
Not sure if I understand it correctly, but it seems to me that the GW for each VLAN is defined on ZyWALL as its starting IP:
ge6/5: 192.168.5.1
ge6/6: 192.168.6.1

However, within Unify network the GWs are defined too for each Unify network - I have defined them as the very second IP from each VLAN network, defined by ZyWALL:
GUEST WiFi:192.168.5.2
INTERNAL WiFi:192.168.6.2

Perhaps this is wrong - perhaps the main GW for WiFi - from the point of view of ZyWALL should be IP defined for ge6 interface:
192.168.4.1
So to have in control all the WiFi mess behind this IP and translate each IP from WiFi to IP form 192.168.4.x.

Not sure, just thinking out loud.