VPN on demand - does it ever work?
For me, vpn-on-demand works if the following conditions are met:


use a named configuration for the VPN interface (not default)
the triggering domain must be a hostname that can NOT be resolved using public DNS
vpn connection is only triggered by Safari (and maybe Mail), but not e.g. afp, vnc, smb connections let alone cli triggered connections like ssh