An Aruba Remote AP (RAP) operates in split-tunnel mode.

It sends all user traffic in a GRE tunnel to a central Mobility Controller (MC), and it sends control traffic in an IPsec tunnel to the controller.

It sends traffic designed to the corporate network in an IPsec tunnel to a central Mobility Controller (MC), and it bridges other traffic locally.

It sends user and control traffic in two separate IPsec tunnels to the Mobility Controller (MC).

It sends all employee and control traffic in a GRE tunnel to a central Mobility Controller (MC), and it bridges all guest traffic locally.