Product and Software: This article applies to ArubaOS versions later than 5.0.
A VIA user is considered a VPN user and can get addresses only from the VPN pool that you have configured on that local controller. So the VPN pool decides what range of addresses that VIA users get.
If that VPN pool is in the same subnet of an IP interface on the controller, then users should be able to communicate with the VLAN corresponding to the IP interface.
If the VPN pool is not in the subnet of one of the IP interfaces of the controller, a static route must be configured in your infrastructure. That static route points to the controller so that traffic can be returned to the VIA clients on that controller.
Configuring the VPN Pool Using the WebUI
Configuring the VPN Pool Using the CLI