Aruba Networks Version 3.3 manual Wlan Extension with Remote AP

The AP itself should be configured to perform split tunneling. In this configuration the AP will perform decryption of wireless traffic and bridge traffic locally when it is bound for a non-corporate address, and re-encrypt the session using IPSec from the RAP to the corporate controller. The connection to the Internet is protected with the same stateful firewall available on the Mobility Controllers to protect the user from inbound traffic.

70 WLAN Extension with Remote AP Campus Wireless Networks Validated Reference Design Version 3.3 Design Guide