I have a VPN setup successfully with IPsec and Certificate.  Everything works fine until I tell the IOS device to use the VPN "On Demand" in the profile setup.  This forces the VPN to connect when you access a specific site/domain.

When I do this, it breaks the VPN.  The iPhone says "An unexpected error occurred." and can't connect.  Here are the logs...  Is this a known IOS issue maybe?

Dec 23 13:45:58	charon: 13[ENC] <24> parsed ID_PROT request 0 [ SA V V V V V V V V V V V V V V ]
Dec 23 13:45:58	charon: 13[IKE] <24> received NAT-T (RFC 3947) vendor ID
Dec 23 13:45:58	charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike vendor ID
Dec 23 13:45:58	charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-08 vendor ID
Dec 23 13:45:58	charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-07 vendor ID
Dec 23 13:45:58	charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-06 vendor ID
Dec 23 13:45:58	charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-05 vendor ID
Dec 23 13:45:58	charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-04 vendor ID
Dec 23 13:45:58	charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-03 vendor ID
Dec 23 13:45:58	charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-02 vendor ID
Dec 23 13:45:58	charon: 13[IKE] <24> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Dec 23 13:45:58	charon: 13[IKE] <24> received XAuth vendor ID
Dec 23 13:45:58	charon: 13[IKE] <24> received Cisco Unity vendor ID
Dec 23 13:45:58	charon: 13[IKE] <24> received FRAGMENTATION vendor ID
Dec 23 13:45:58	charon: 13[IKE] <24> received DPD vendor ID
Dec 23 13:45:58	charon: 13[IKE] <24> 0.0.0.0 is initiating a Main Mode IKE_SA
Dec 23 13:45:58	charon: 13[ENC] <24> generating ID_PROT response 0 [ SA V V V V V ]
Dec 23 13:45:58	charon: 13[NET] <24> sending packet: from 1.1.1.1[500] to 0.0.0.0[4708] (180 bytes)
Dec 23 13:45:58	charon: 14[NET] <24> received packet: from 0.0.0.0[4708] to 1.1.1.1[500] (228 bytes)
Dec 23 13:45:58	charon: 14[ENC] <24> parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
Dec 23 13:45:58	charon: 14[IKE] <24> remote host is behind NAT
Dec 23 13:45:58	charon: 14[IKE] <24> sending cert request for "C=XX, ST=XXXXXX, L=XXXXXX, O=XXXXXX, E=XXXX@XXXXXX.XXX, CN=XXXXXX"
Dec 23 13:45:58	charon: 14[ENC] <24> generating ID_PROT response 0 [ KE No CERTREQ NAT-D NAT-D ]
Dec 23 13:45:58	charon: 14[NET] <24> sending packet: from 1.1.1.1[500] to 0.0.0.0[4708] (389 bytes)