Is this setup overly complex? ASUS XT8's (AP) + XD4's

[AKLT]

Happy Lunar New Year to those celebrating in the forum!

As I get closer to moving into my home I started to put more thought into my setup.
Since it's a good idea to segregate my IoT devices (locks, Apple TV, Light Switches, etc), it caused a pickle since I plan to put my XT8's in AP mode since I will have a Firewalla Gold between them and the modem.

This results in the XT8's losing its bells and whistles which include guest network.

My solution:
Connect XD4's into the XT8's LAN ports to and create its own SSID solely for IoT devices

This way I can also have a guest network setup if necessary.

What do you folks think?

 

[L&LD]

A unique SSID doesn't mean segregated, by default. Nor does Guest network mean anything either, when all will be in the same DHCP scope.

Is the Firewalla Gold capable of VLANs? If so, segregate them with that instead.

 

[AKLT]

A unique SSID doesn't mean segregated, by default. Nor does Guest network mean anything either, when all will be in the same DHCP scope.

Is the Firewalla Gold capable of VLANs? If so, segregate them with that instead.

Sorry, should have provided a tad more details.

By having the additional router with its own SSID's (for IoT & Guests, after the XT8 in AP mode), I figured I would set up the rules within Firewalla directly to control the traffic and access between the main SSID and the IoT/Guest SSID.

Yes the FWG can do this via the ports directly, but since the each room only has 1 LAN port, and it will be taken up by the XT8, wanted to create a secondary mesh across the house for IoT's.

 

[Tech9]

My solution:
Connect XD4's into the XT8's LAN ports to and create its own SSID solely for IoT devices

I'm assuming you are thinking both in router mode, in double NAT. It won't work, because what's connected to XD4 Guest Network will have access to XT8 main network. XD4 Guest Network will be only separated from it's own main network. With x86 Firewalla Gold appliance I would ditch the home routers and build a proper VLAN capable centrally managed SMB Wi-Fi system with PoE AP's. Once you see the difference, there is no coming back to AiMesh.