If you are using the AP system profile to send rtls information to Airwave, the IP address of the access point must be routable, because the rtls info comes directly from the AP. That means your ipsec pool needs to be IP addresses on a routable subnet on the controller.