Optimal vlan setup for complex project

[davidfi01]

I have an opnsense project involving multiple vlans, a router, 3 smart switches, and 4 APs.

I have a vlan set up for:

Guest (vlan05)

Automation (vlan04) 192.168.4.0/24

IoT (vlan03)

Native (vlan01) 192.168.2.0/24

Currently, the 3 switches and 4 access points are managed though vlan04. They have 192.168.4.xxx static ip addresses.

The router and business' computers are on vlan01, the native vlan with the ip address of the router at 192.168.2.1, and the other computers either through DHCP or static ip addresses.

I think that I want to move the router, switches and ap to 192.168.1.0/24 and make that the native vlan.

I would keep the business computers and printers on 192.168.2.1/24 and create another vlan (vlan02) for them.

Is this the best way to configure opnsense? Should the switches, ap's and router be on the native vlan (vlan01)?

Thanks in advance for your comments.

[bartjsmit]

For maximum security set up a management VLAN separate from the production traffic