In Aruba AOS 10 Tunnel Mode (specifically Decrypt-Tunnel), the Overlay Tunnel Orchestrator (OTO) facilitates the control plane by handling the Negotiate IPsec Phase 1 function (generating and distributing key material), effectively replacing the traditional IKE Phase 1 between peers. The Access Point and Gateway then utilize this key material to Negotiate IPsec Phase 2 (establishing the IPsec/GRE Data Tunnels). Regarding 802.1X, the Access Point acts as the Authenticator (handling encryption/decryption at the edge), while the Device Designated Gateway serves as the termination point for the tunnel and acts as the RADIUS proxy to the AAA server.

Aruba Campus Access Webinar Part 2 (Slide 21): Explicitly lists "Negotiate IPsec Phase 1" under OTO Service and "Negotiate IPsec Phase 2" under APs and Gateways.

Aruba AOS 10 Terminology Guide: Confirms that in AOS 10 Tunnel Mode, the "AP acts as an authenticator while the Gateway acts as authentication proxy" (RADIUS proxy).

HPE Aruba Networking TechDocs (Tunnel Orchestrator): Describes the OTO's role in automating tunnel establishment and distributing IPsec keys.