Product and Software: This article applies to all Aruba controllers and ArubaOS 2.5.x.
The Remote AP control traffic sent to the switch is over an IPSec tunnel. The user traffic will be encrypted as per the AP/user authentication/encryption configured. If the administrator wants the user traffic to be further encrypted using IPSec, then you must enable double encryption:
(WLAN_Switch) (config)# ap location 10.0.0
(WLAN_Switch) (sap-config location 10.0.0)# double-encrypt enable
(WLAN_Switch) (sap-config location 10.0.0)# exit
NOTE-Aruba recommends that double-encryption not be turned on for inter-device communication over untrusted networks in ArubaOS 2.3 or higher, as doing so is redundant and adds significant processing overhead for APs.