If you're saying the client has a valid profile, and when connecting using that profile, the connection fails, the following info
can be helpful.
Sometimes the most useful info is from the client Diagnostic logging, and basic
connectivity testing from client to the controller.
Ensure the profile downloaded has provided a valid IP for the controlle.
On the controller, check the datapath during the client connect to see inbound traffic,
we're usually looking for ports 443, 4500, 500
show datapath session
Enable debug logging:
logging level debugging user-debug <client mac>
logging level debugging security process crypto subcat ike
logging level debugging security process authmgr
Check inbound IPSEC traffic
show crypto isakmp sa
show crypto ipsec sa
show datapath tunnel
If this proves ineffective, I'd recommend to open a case with Aruba Technical Support, provide the VIA client logs, and any controller data you've gathered.
Hope this Helps.