Forcing VPN on demand to "on" When we install an iOS configuration profile for Cisco IPSec "VPN on Demand" (using certificate based machine authentication), a switch appears in the Settings > VPN Settings page: "Connect On Demand ON/OFF".

We don't want to give our employees the option to turn off VPN on Demand.  Is there a way to force VPN on Demand to "ON" all the time for MDM (mobile device management) deployed configurations?

Or alternatively, is there any other way to force user traffic to a proxy under our control?  

Rumour has it that iOS 6 will include Global HTTP Proxy settings.  Will enterprise IT admins be able to force this setting to "ON" all the time?
As of iOS 11 there's still no ability to disable the on/off switch for VPN Connect on Demand, even in Supervised mode. The built-in IKEv2 VPN has an Always On setting, but that's not going to apply the Cisco or other 3rd-party VPNs.