Hello Adam,
Unfortuantely Cisco IOS routers do not support the Cisco AnyConnect Secure Mobility client for Apple iOS at this time.
http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect30/release/notes/rn-ac3.0-iOS.html#wp1124492
It's on the roadmap though and tracked by CSCtx24822
Also regarding the On-Demand I wanted to point out that Apple has made some significant changes to their VPN On Demand framework with the release of Apple iOS 7:
- Deprecated the use of the OnDemandMatchDomainsAlways plist key. Any domains contained within the "Always Connect" list will now be treated as if they were in the "Connect If Needed" domain list by the system.
- The evaluation model of the ruleset has changed to support a dynamic number of rule types providing additional flexibility to the Administrator.
- Additional Network Detection conditions, actions, as well as new tertiary rulesets on the domain matching rules.
In Apple iOS 5 and earlier, there was one type of matching rules, the domain-matching rules described in the relevant section. Apple iOS 6 introduced a new type, network detection rules, that acted whether to enable or disable the domain-matching rules as dictated by a set of conditions based upon the WiFi interfaces network attributes. In Apple iOS 7 a similar concept remains, except that network detection rules take precedence where you can now define a VPN on Demand ruleset that does not use any domain-matching rules if you choose not to include them.
http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect30/user/guide/iphone-ugac-ios.html#wp188630
"Apple iOS 7 no longer supports Always Connect domains. When running AnyConnect on Apple iOS 7 devices, any domains listed asAlways Connect will be treated as Connect if Needed domains."
-Gustavo Medina
