You may want to see if a vlan is necessary on your network, specifically if you are running VoIP.

With a 1200 series Ap, all you have to do is configure the ssid as authentication open on the unsecured, and add the security to the other ssid.

This is what I have ...

dot11 ssid secured

authentication open eap eap_methods

authentication network-eap eap_methods

accounting acct_methods

!

dot11 ssid unsecured

authentication open

infrastructure-ssid optional

!

interface Dot11Radio0

no ip address

no ip route-cache

!

encryption mode wep mandatory

!

broadcast-key change 10800

!

!

ssid secured

!

ssid unsecured

!

Hope this helps.

I have done this for AP1200s, but not 1100s.