Is it not needed (nor advised) to give your VIA clients IP addresses in a real subnet connected to the controller. In most cases it is better to configure your VIA users pool with an address range that only exists on the controller, and for which you have a route in your network to the controller.
That avoids the need to use NAT, which can introduce other complexity.
This topic is covered in the VIA AppNote that is available here. Start reading on page 17, Address Pools, for this specific topic including some references to other documents.