How to VPN on demand Mac OS X?

"At least on Sierra, it is possible to create a VPN on demand profile (mobileconfig file) as for iOS (reference here), and import this into macOS. After that, a VPN connection will appear in the network settings with an on-demand checkbox.

However, it does not seem to work exactly as expected. In my case, I've setup an IPSec on-demand VPN using OnDemandRules with Domains to connect whenever my LAN domain is not available. Now the VPN connection seems to be automatically established whenever the local domain names cannot be reached. Yet, I would expect it to connect only when I actively try to connect to one of those domains.

In addition to that, the VPN behaves differently from my iPhone in that, on my Mac, all traffic is sent through the VPN (all tunneled), while on the iPhone it is only the traffic to my local net that is sent through the VPN (split tunneling)."