I have a similar setup but.... the untagged network is the management network for the APs. All traffic on the WiFi network is done in VLANS. That is how I have it setup.
So in that case you should have 3 definitions on eth1 (assuming traffic for the clients is using VLAN 10 and 11)
auto eth1 eth1.10 eth1.11
iface eth1 inet static
address .....
etc
iface eth1.10 inet static
address .....
etc
iface eth1.11 inet static
address .....
etc
This should also prevent any miscommunication when clients are part of the management network.
The "management network" does not NEED to be a separate network. In my case I combine it with another network which has restricted access.
Also be aware that I have found VLAN aware routing on a Debian machine to be slower then straight interface routing. However, my last test was on an old Lenny system so that might have been improved.
Bonno Bloksma