I have a 4 7220's in a master/local relationship for our guest access essid. They (Aruba controllers) were running as one of the two firewalls (in conjunction with a fortinet) to allow guest traffic through their L2 pathway to the internet. Recently, we've simplified things and made the fortigates the only firewall and added the 'allowall' to the guest role. It's taken a week or so, but I got some feedback that iOS streaming apps (YouTubeTV,Netflix, Plex, etc) are not working (to which we can duplicate on other iOS devices.) Android works just fine. To cover our bases we've even tried a different firewall (latest stable code and identical flavor as other working sites and functions) to no avail. Our group is scratching our heads as it doesn't look like a role based issue and is only stuck to this one essid from this one pair.
Drawback: I still have 6.3.1.xx code and can't upgrade till the boatanchors (AP65) are completely gone