I agree with the guys that have posted. If you need full IPSEC to the AP and not just control traffic run the APs as RAPs. Keep in mind the APs have a speed limit for IPSec throughput such as the 225 are 100Mbps, i think 320 Mbps, 203h 20Mbps, and 303h 100Mbps. We are currently re-doing our controller that manages RAPs in employees homes and are opting for 303h since the RAPs are mainly for the network engineering team and we use them as a backup link over the internet for over 50 sites.