Always-On VPN and Apple Classroom on iPads

[beedee]

Since we couldn't reliably do VPN only when offsite, we have Always-On VPN always-on for students, even when on-site.

This has achieved many (but not all) of our objectives so far on managed devices - in terms of ensuring that internet traffic is always passing through the firewall.

Enter Apple Classroom. Our firewall vendor (Cyberhound) uses strongswan. Even if we put a teacher on the same IKEv2 JSS-configured Always-VPN, they can't see each other.

Any ideas? Could we have done something on the (or a..) VPN server to make VPN clients bridged to a common network? Is that even possible with IKEv2 VPN?

Thanks

[beedee]

We've investigated On-Demand VPN, but despite the rules, users can still disabled these connections, so unfortunately, this is no good for us.
The only restrictions available that we've seen is to prevent users from adding / editing VPN connections. Does nothing to block use of this button:

Link to larger image

[beedee]

We need something like this for On Demand VPN:

Link to larger image