Create subinterfaces both in dotradio0.x and fast0.x like this. So you can link the SSID to the vlan that you pretend.
Interface BVI1 is for management on vlan 1, and the SSID Corporate its on the VLAN2.
!
interface BVI1
no ip route-cache
no keepalive
arp timeout 60
ip address 192.168.1.1 255.255.255.0
exit
!
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service sequence-numbers
!
hostname AP:2_XXXXX
!
logging buffered 16384 debugging
no logging console
no logging monitor
clock timezone Portugal 0
ip subnet-zero
no ip source-route
no ip gratuitous-arps
ip telnet hidden addresses
no ip domain lookup
!
aaa new-model
!
aaa authentication login default local
aaa session-id common
!
bridge irb
!
dot11 location isocc pt cc 351 ac 999
dot11 network-map 60
!
interface Dot11Radio0.1
description Rede Gestao
encapsulation dot1Q 1 native
no ip address
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
exit
!
interface Dot11Radio0.2
description Rede Users
encapsulation dot1Q 2
no ip address
ip access-group 101 in
no ip route-cache
no ip unreachables
no ip proxy-arp
bridge-group 2
bridge-group 2 port-protected
bridge-group 2 subscriber-loop-control
bridge-group 2 block-unknown-source
no bridge-group 2 source-learning
no bridge-group 2 unicast-flooding
bridge-group 2 spanning-disabled
exit
!
interface FastEthernet0
no ip address
no ip unreachables
no ip proxy-arp
no ip route-cache
logging event subif-link-status
speed 10
full-duplex
no keepalive
arp timeout 60
no cdp enable
hold-queue 100 out
exit
!
interface FastEthernet0.1
description Rede Gestao
encapsulation dot1Q 1 native
no ip address
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
exit
!
interface FastEthernet0.2
description Rede Users
encapsulation dot1Q 2
no ip address
no ip unreachables
no ip proxy-arp
no ip route-cache
no keepalive
arp timeout 60
no cdp enable
bridge-group 2
no bridge-group 2 source-learning
bridge-group 2 spanning-disabled
exit
!
interface Dot11Radio0
no ip address
no ip unreachables
no ip proxy-arp
no ip route-cache
logging event subif-link-status
!
ssid Corporate
!
world-mode
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
rts threshold 2312
station-role root
rts retries 32
power local cck 50
power client 50
packet retries 32
channel 6
fragment-threshold 2338
payload-encapsulation dot1h
no keepalive
no cdp enable
no dot11 extension aironet
no short-slot-time
exit
!
dot11 ssid Corporate
vlan 2
max-associations 64
authentication open
guest-mode
exit
!
ip default-gateway 192.168.1.254
control-plane
!
bridge 1 route ip
!
