Environment : This article applies to all the models of Aruba Mobility Switches and OS version 7.0 and above.
A tunneled-node Mobility Access Switch (MAS) is treated just like any normal Access Point on the Aruba Controller acting as Tunneled server, so only one AP license is needed to tunnel wired traffic from the Mobility Access Switch to the Aruba controller. Even if traffic is tunneled from a MAS stack with multiple MAS switches, only 1 AP license is needed on the controller.
To enable role-base policy enforcement, a single PEF license is required and to enable WLAN Intrusion Protection feature, a single WIPS license is needed.
Also, please note -
Tunneled-node is supported from MAS (Mobility Access Switch such as S2500/S3500) release 7.0 and above.
Tunneled Server (Mobility Controller) must be running on AOS version 6.1 or higher.