This relates to the old "E" series controllers and AP's. They were offered at a low cost because they do what tunneled node on the MAS does today. Mostly a MUX solution. An e series controller ran Aruba OS (or the AP 70E) but they didn't terminate AP's (or the 70E had no radio in it) what they did was build a GRE back to the controller for wired devices. The wired devices would authenticate but not see each other as they would in a HUB or L2 switch. They were on a MUX- . The entire switch cost you (1)AP and (1) PEF license.
You would log into the AoS on the E series controller and point it back to the wired access concentrator (the loop back address of where you wanted the GRE to go) . That Controller where GRE terminates was the Wired Access concentration server (check box enabled).
The segment between the MUX and controller was inaccessible to wired devices, and you were using the auth and firewall for wired users- see the secure jack section of controller Bootcamp presentation. These are legacy and have been replaced with tunneled node in the MAS switch and secure Jack off current AP's. E series devices are end of sale/support years ago (believe this came from version 3.x and before Aruba OS).
Hope that explains it -