Hi Marcelkoedjk,
From the guide:
"Establish secure IPsec tunnels between the primary licensing server controller and the licensing client controllers by enabling control plane security on that cluster of master controllers, or by creating site-to-site VPN tunnels between the licensing server and client controllers. This step is not required, but if you do not create secure tunnels between the controllers, the controllers will exchange clear, unencrypted licensing information. This step is not required for a master-local topology."
"If the tunnel is not established by the user, the messages exchanged between the master controllers will be sent in clear."
So from that parapgraph, I'd say that if you have IPsec between your controllers that will traffic be encrypted.
Additionally: https://community.arubanetworks.com/t5/Controller-Based-WLANs/What-port-numbers-should-be-alllowed-to-enable-centrallized/ta-p/233977