On Demand IPSec VPN for iOS

on-demand-ipsec.mobileconfig

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>        <dict>
      <key>UserDefinedName</key>
      <string>On Demand IPSec</string>
      <key>PayloadDisplayName</key>
      <string>On Demand IPSec</string>
      <key>PayloadIdentifier</key>
      <string>com.vpn.ipsec</string>
      <key>PayloadUUID</key>
      <string>72EEE1DE-A52A-BC62-D2FF-47E7DE00A0E8</string>
      <key>VPNType</key>
      <string>IPSec</string>
      <key>IPSec</key>
      <dict>
          <key>RemoteAddress</key>
          <string>ADDRESS-GOES-HERE</string>
          <key>AuthenticationMethod</key>
          <string>SharedSecret</string>
          <key>XAuthName</key>
          <string>USERNAME-GOES-HERE</string>
          <key>XAuthPassword</key>
          <string>PASSWORD-GOES-HERE</string>
          <key>XAuthEnabled</key>
          <integer>1</integer>
          <key>LocalIdentifier</key>
          <string>GROUP-GOES-HERE(BLANK FOR NONE)</string>
          <key>LocalIdentifierType</key>
          <string>KeyID</string>
          <key>SharedSecret</key>
          <string>SECRET-GOES-HERE</string>      </dict>
      <key>OnDemandEnabled</key>
   <integer>1</integer>
   <key>OnDemandRules</key>
          <array>
        <dict>
          <key>InterfaceTypeMatch</key>
          <string>WiFi</string>
          <key>SSIDMatch</key>
          <array>
 <string>SSID-GOES-HERE</string>
           </array>
          <key>Action</key>
          <string>Disconnect</string>
        </dict>
        <dict>
          <!-- VPN Default state -->
          <key>Action</key>
          <string>Connect</string>
        </dict>
          </array>
      <key>OverridePrimary</key>
      <true/>
      <key>IPv4</key>
      <dict>
        <key>OverridePrimary</key>
        <integer>1</integer>
      </dict>
      <key>PayloadType</key>
      <string>com.apple.vpn.managed</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
    </dict>
</array>
  <key>PayloadDisplayName</key>
  <string>VPN Configurations</string>
  <key>PayloadIdentifier</key>
  <string>8B68F93D-D03D-38B5-BCA5-85B7D228E9A1</string>
  <key>PayloadRemovalDisallowed</key>
  <false/>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>02CB6F5C-4BE2-881F-8964-D14925B5B091</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>

This profile will connect to the VPN whenever the device is not connected to the listed wireless SSID. Tested successfully with https://github.com/hwdsl2/docker-ipsec-vpn-server/.

Replace the values marked with GOES-HERE to match your setup, and AirDrop the file to your device.