Both the standalone roaming client and the AnyConnect Umbrella roaming module—version 4.8 MR3+ and Windows only—support IP Layer Enforcement.

The AnyConnect Plugin: Umbrella Roaming Security Client Administrator Guide < IP Layer Enforcement > Frequently Asked Questions