If you look at the price of a PEFV license I would sure hope that would include the PEFNG. :P
But you sure can create and apply user-roles to any user-type with just the PEFV license.. See the output blow or test yourself.
In fact.. the only thing I've found that doesn't work with just the PEFV is the rfc-3576 server and that pops up an error that it can't do a certain show command where normaly the entry would just be hidden.
(Staging-Aruba3600) #show license
License Table
-------------
Key Installed Expires Flags Service Type
--- --------- ------- ----- ------------
<lic key here> 2013-02-27 2013-03-29 E Access Points: 2048 03:14:31[2] 03:14:31
<lic key here> 2013-02-27 2013-03-29 E Policy Enforcement Firewall for VPN users 03:14:42[3] 03:14:42
License Entries: 10 (all the others are not enabled)
Flags: A - auto-generated; E - enabled; R - reboot required to activate
(Staging-Aruba3600) #show rights
RoleTable
---------
Name ACL Bandwidth ACL List Type
---- --- --------- -------- ----
ap-role 4 Up: No Limit,Dn: No Limit System
authenticated 59 Up: No Limit,Dn: No Limit allowall/,v6-allowall/ User
block-ftp 54 Up: No Limit,Dn: No Limit block-ftp/,allowall/ User
block-telnet 56 Up: No Limit,Dn: No Limit block-telnet/,allowall/ User
cpbase 14 Up: No Limit,Dn: No Limit cpbase/ User
default-via-role 58 Up: No Limit,Dn: No Limit allowall/ User
default-vpn-role 55 Up: No Limit,Dn: No Limit allowall/,v6-allowall/ User
denyall 12 Up: No Limit,Dn: No Limit denyall/ User
guest 3 Up: No Limit,Dn: No Limit User
guest-logon 6 Up: No Limit,Dn: No Limit User
logon 1 Up: No Limit,Dn: No Limit User
stateful-dot1x 5 Up: No Limit,Dn: No Limit System
sys-ap-role 7 Up: No Limit,Dn: No Limit sys-control/,sys-ap-acl/ System (not editable)
voice 57 Up: No Limit,Dn: No Limit sip-acl/,noe-acl/,svp-acl/,vocera-acl/,skinny-acl/,h323-acl/,dhcp-acl/,tftp-acl/,dns-acl/,icmp-acl/ User
Total Roles:14
(Staging-Aruba3600) #show u
Users
-----
IP MAC Name Role Age(d:h:m) Auth VPN link AP name Roaming Essid/Bssid/Phy Profile Forward mode Type
---------- ------------ ------ ---- ---------- ---- -------- ------- ------- --------------- ------- ------------ ----
192.168.253.19 60:67:20:ca:b1:28 dimitri block-telnet 00:00:00 802.1x cppm-poc-105 Wireless cppm-poc/d8:c7:c8:6a:1d:a8/a-HT cppm-poc tunnel
User Entries: 1/1
So, could you please doublecheck this info and get back to us?