The Tag on port 1/1/1 seems fine, however take in consideration that you need to tag all the ports where access point are connected and also the port that going to your ISP router, because that is the gateway for all the traffic.
Technical Support Engineer | L2 TAC Wired | Lennar Home Community
Are you a Lennar customer? Now from the Switch you can create multiple VLANs, and assign those VLANs by SSID, however your ISP router must be able to provide DHCP for all those VLAN/SUbnets, now from the Switch it is able to become your DHCP server for those VLANs, but it is the same, the ISP router must be able to manage all the new subnets and by default only the enterprise routers are capable for that.
You can create as many VLANs as you want and then assign those VLANs by SSID, however, keep in mind that your router must be able to function as a DHCP server for each VLAN, this means assigning a different subnet for each VLAN you have created, then on the ICX 7150 Switch you need to tag all the new VLANs you have created on the ports you have connected the Access Points and to the port where the ISP router is connected; however, if you have no idea what I am trying to explain I advise you to hire an experienced network technician; however, let me give you the steps.
1:Gain access to the Switch via CLI(command line interface)via SSH, Telnet or console.
How to remotely access to 'ICX 7150-12P' or 'access points' "Network devices"
show lldp neighbor (here you can discover in which ports the access points are connected)
show mac-address (you can discover what port the router is connected)
Note: take into consideration that if you have other devices wired to the Switch and those devices are required to get an IP address in one specific VLAN that device must be untagged, for example, a computer.
Configuring the VLANs.
tagged ethernet 1/1/1
tagged ethernet 1/1/2
Note: you will tag all the VLANs you have created for the SSIDs, by default VLAN 1 will be untagged which is the VLAN where the Access Points get their own IP address, now if you have created another management VLAN that VLAN must be untagged to remove the regular untagged for VLAN 1, the next document will explain more technical the VLAN segregation, also remember to tag all those new VLAN to the port where the ISP router is connected, so the Switch allows the traffic coming from those VLANs, take in consideration that if you have a device wired to the Switch such a computer and belong to a not management or default VLAN, the VLAN that belongs to, must be untagged, because end devices do not understand the consent of tagging.
How do I segregate traffic between two SSIDs using VLANs
Here is my running/saved config. Is the VLAN set properly on Putty? Or do you need more information? I'm trying to narrow it down if it is a router or switch configuration issue. I hope to setup the switch accurately and move on to router diagnosis.