On demand has the effect of the VPN tunnel being started "on demand" based on a set of triggering criteria. Currently there are no criteria in place, so it always triggers.