Cisco AnyConnect Secure Mobility Client has been configured to use IKEv2 for one group of users and SSL for another group. When the administrator configures a new AnyConnect release on the Cisco ASA,

The XML profile governs client behavior and connection preferences but is not the component that controls whether software packages can be downloaded over IKEv2.

AnyConnect supports upgrades across major release versions and the major release number alone does not block the automatic download mechanism.

Unlike SSL, IKEv2 does not use a web portal for package delivery, so the ASA must have 'anyconnect-client-services' enabled on the outside interface to allow IKEv2 clients to contact the update service. Without this configuration, the new image is never offered to IKEv2 users while SSL users continue updating normally through the HTTPS portal. Enabling client services creates the separate update channel that IKEv2 requires.

IKEv2 does support automatic client updates when client services are properly enabled on the ASA, so the protocol itself is not the limitation.