Switch – 3Com Baseline 2824 SFP Plus (HP JE738A) VLANs

If you assign switch ports to specific VLANs, the switch treats them as if they were all in their own little Ethernet network, and the end stations are usually unaware that they're connected to a VLAN-based switch.

If a switch port is tagged, that means that all of the frames that aren't in the default VLAN (usually 1, which you're right to leave alone) have a 4-byte 802.1q header attached that says what VLAN they go with (as well as basic QoS information). A device attached to a tagged port needs to be aware of the VLAN setup if it's going to properly process such packets, but these are typically other switches (either traditional switches or software switches inside a VM hypervisor).

You should usually force end-user ports to untagged to ensure that someone can't insert a custom VLAN tag and get access to a different VLAN (known as VLAN hopping). On your switch, all of the ports should be untagged unless the WiFi APs are capable of talking on multiple VLANs so that they can have a management address on a different VLAN from the one they're sending client traffic over, or so that single APs can connect multiple SSIDs to different VLANs.

Whether a "basic" switch "handles" VLANs depends on what each term means. Most unmanaged switches will simply pass 802.1q-tagged frames along as-is, with no attempt to direct them anywhere in particular, so plugging an unmanaged switch into an untagged port is simply the same as not using VLANs at all, while plugging one into a tagged port is like having a shared tagged segment among the different equipment that knows about the VLANs.

The HP 2520 is a layer 2 switch: all you can do with it is bridge the individual VLANs tagged on port 48. Then, as long as what is at the other end of it has the right VLANs, gateway addresses and routing set up, all should be fine.

Update: any intermediate switches will also need the VLANs present: tagged on both the uplink and downlink ports.

You do not need to worry about IP ranges.