Well, you still have WAN2 left to use as needed, you've occupied WAN1, Internet, DMZ. Note that the names are completely arbitrary, you could readily install it backwards or assign them to any arbitrary role. Their being hardcoded as they are is a somewhat unfortunate fact; you can abstract them by creating more aptly named zones and putting one interface in each zone, then building all your policies on zones. This also allows you to change interfaces around by simply switching the zone definitions in your config. But anyway, back to the question:
1) You could put the WAP and the NM server on the same subnet on WAN2. (bad, wireless could hit NM server directly) 2) You could configure the NM server on VLAN1 and put VLAN1 in a new zone called DMZ2 using the WAN2 interface. That gives you a completely separate zone and set of policies. Then put the WAP on the WAN1 interface the normal way. (preferred, full control) 3) You could put a secondary IP on the WAN2 interface and configure the WAP for the secondary IP and the NM server on the primary network. The put in a WAN2 :: WAN2 deny policy to prevent traffic between them. (next best after vlans, bad because if wireless could somehow figure out to add a second IP on their NIC in the right range, they could hit the NM server directly. Unless your WAP can be configured to block such traffic)-Russ.