BTW, a quick way to understand where the iPAD (or any client) is communicating would be to issue a ' show datapath session table | include x.x.x.x '
If the client is 'tunneled' to the controller this command will show you all the traffic as it arrives/departs from the controller from the client at ip address x.x.x.x.
Handy, if all you want to do is understand what destinations that iPAD is going to for a first cut.
You will notice all Apple devices communicate to 17.x.x.x (The Apple mother ship) on a routine basis. That is usually an eye opener for many that didn't know that natively happens. ;)
JF