Your customer has an existing gateway cluster that they are using to tunnel traffic from...

The customer wants to tunnel traffic from APs through CX switches, similar to what they currently do with a gateway cluster. Aruba’s User-Based Tunneling (UBT) is designed specifically for this use case. UBT allows traffic from wireless and wired clients to be tunneled to a centralized gateway or controller for policy enforcement and traffic inspection.

IPSec and GRE are general tunneling protocols but not Aruba’s recommended solution for AP traffic.

VNBT relates to colorless ports and dynamic segmentation, not tunneling client traffic.

Thus, UBT is the correct tunneling solution for AP traffic through CX switches.