Forcing VPN on demand to "on"
As of iOS 11 there's still no ability to disable the on/off switch for VPN Connect on Demand, even in Supervised mode. The built-in IKEv2 VPN has an Always On setting, but that's not going to apply the Cisco or other 3rd-party VPNs.