The Always option for matching domains is no longer supported; Always domains will be automatically converted to If Needed domains in existing configurations.
Enhancements have been made to the VPN On Demand feature in iOS 7 to support the following scenarios:
| Desired Behavior | 
			iOS 7 Configuration | 
		
|---|---|
| Trigger VPN for all traffic from the device. | 
			Configure with the Connect option. | 
		
| Trigger VPN when DNS servers redirect internal host names to landing pages. | 
			Automatic for If Needed domains. | 
		
| Trigger VPN when internal host names are externally resolvable but connections cannot be established. | 
			Automatic for If Needed domains. | 
		
| Trigger VPN to access internal sides of dual-facing hosts. | 
			Configure with the Required DNS Servers option for If Needed domains. | 
		
For information on how to configure VPN On Demand profiles for iOS 7, see the VPN Payload section of the Configuration Profile Key Reference Guide.