Config please.
Or no help.
It's there @holvoetn:
@Alex-Pebody, are you familiar with the documentation?
Please choose the VLAN approach for isolating networks.
Still in doubt why you were referring to a CCMP issue...CCMP is default.
Missed it, was nicely hidden there 
Reset caps devices to caps mode since you're doing quite a bit on them which is not needed.
And then follow VLAN capsman example from Help pages, as suggested.
There is another option for EoIP. Create another bridge for the guest network on 5009, configure the DHCP server on it, similarly to guest bridges on access points, and connect the EoIP tunnels to the corresponding bridges.
PS And yes, “wifi capsman” does not yet know how to transmit user data through itself. Only the mode where traffic is managed by the access point is supported.
Guys thx for all. I used VLAN's schema now for split DHCP's and yes... wait resolved capsman traffic processing... ( "sad, but true" (c)
With 7.19x,
On RB you don't need extra package
On AX3, you need the qcom package only
Yes thx exactly )