Hello,
I have 2 APs (BaseBox2 and RB411AH) that have bridged ethernet and wireless interfaces and they are connected by ethernet to a third routerboard (RB2011L). On RB2011L is running hotspot server for these APs for our customers. See the attachment.
Now I need to create another WPA2 secured WIFI for our employees which will be excluded from hotspot server and will be used for internet access and occasionally for access to our main corporate network (connected by IPSec VPN on the same RB2011L). I tried to use VLANs, but I failed miserably. Can you please suggest me some configuration that will work? Is it even possible?

(I have separate problem with this configuration - I need to have some management access to APs for monitoring and configuring, but I was unable to configure RB2011L to pass comunication from corporate network and at the same time make the hotspot running.)