Hello Mr. Chellis, Enabling the Apple iOS Connect On Demand Feature The Apple iOS Connect On Demand feature enables the establishment of VPN connections specified in the Domain List  without user interaction. All applications should be compatible with  the Connect on Demand framework. However, it is not possible to prevent  an application that makes a DNS request from potentially triggering a  VPN connection. Connect on Demand supports only certificate  authenticated connections (see Using Certificates). Please reffer to http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect24/iphone-user/guide/iphone-anyconnect-ug-24.html#wp54311 https://supportforums.cisco.com/thread/2132205 HTH Anoop ... View more

David, Use the following wild card in the XML profile against CN %USER% regards Anoop ... View more

Please try the following steps if not done already. http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00809b4754.shtml#rty regards Anoop ... View more

Hi, For what i know, there is no command on the ASA which would be conclude if or when the last time any tunnel was active. All you can do is check what all tunnels are currently active using the following show commands. sh vpn-sessiondb detail l2l or use sh vpn-sessiondb summary (look for l2l). regards Anoop ... View more

Hi Dave, See if this helps. https://supportforums.cisco.com/thread/2138800 regards Anoop ... View more

Hi Ricardo, Does it work with the smart tunnel enabled? regards Anoop ... View more

Try access-list splittunnel_acl permit ip localofficehosts 255.255.255.0 vpndhcppool 255.255.255.0 vpngroup group-name split-tunnel splittunnel_acl http://www.cisco.com/en/US/docs/security/pix/pix63/command/reference/tz.html#wp1099471 regards...anoop ... View more