Is vlan hopping a concern when using Aruba's IAP? From my understanding, traffic between a client and an AP has no tag. Once the AP recieves the packet, it then add the correct tag. The other concern would be that a client can add a tag manually so that when it reaches the AP, it already has a tag. Does the AP strip and traffic of tags and then re-tags it correctly?