So we are working on a couple of things right now.
We control our captive portal traffic through a GRE tunnel back to a central location so we can force the traffic to go through a filtered proxy, unauthenticated. We are looking to add another 100+ controllers this year that builds on the current couple hundred controllers with GRE tunnels already, so I am contemplating adding another controller with a couple of 100 tunnels to it like a concentrator for our iPhone deployment so we can do the same thing with that traffic, snce not everthing in and on the iPhones is proxy aware.
That briefly sums it up but the reason I ask is more for the one that defaults the traffic to proxy for web traffic to be filtered, since it is more like the end point for all the controllers...I suspect I can terminate them to a Cisco router, but would prefer to make the concentrator an Aruba controller.