Here are the parts pertinent to the GRE tunnels.
(I've also left the captive-portal bits in in case whomever finds this artifact later might find that part useful)
The interesting bit is the "gre per-ap-tunnel" and the "ip dhcp guest = server-type Centralized,L2"
gre per-ap-tunnel
gre primary 10.21.0.65
gre type 0
mgmt-auth-server CLEARPASS
name <VC name>
virtual-controller-ip <VC IP>
wlan access-rule guestW
rule any any match any any any permit
wlan auth-server CLEARPASS
acctport 1813
cppm-rfc3576-port 5999
ip <clearpass IP>
nas-ip <VC IP>
port 1812
rfc3576
wlan captive-portal
authenticated
background-color 13421772
banner-color 16777215
banner-text "WinCo Foods Guest Network"
terms-of-use "This network is not secure, and use is at your own risk"
use-policy "Logging in as a registered user indicated that you have read, or at least agree to our Acceptable Use Policy"
ip dhcp guest
server-type Centralized,L2
server-vlan 100
routing-profile
route 0.0.0.0 0.0.0.0 10.21.0.65
wlan ssid-profile guestW
auth-server CLEARPASS
captive-portal internal
essid guestW
type guest
vlan 100