Nice! Same thing on Big Sur - "preparing" has it, "ready" and after no more. It also works in path_changed_handler block - kind of makes sense, I can stash it away there. In my case this is a UDP connection, so this can be done without actually sending any packets. Thank you, Quinn!

Still spotty though, in case of a route pointing at VPN interface doesn't ever return anything. I'd expect it to work like route -n get IP So gateway output points at your next hop.

Having exactly same issue - cannot install com.apple.webcontent-filter from .mobileconfig file (system throws an error "Profile installation failed." "The ‘VPN Service’ payload could not be installed. The VPN service could not be created." The config is essentially identical to the OP. In the console I get this CPProfileManager.installProfile returning error -319 (The ‘VPN Service’ payload could not be installed. The VPN service could not be created.) CPProfileManager.installProfile for user 'zandrey' returning = -319 (INSTALL FAILED)

I'll answer my own question. Profile needs system scope defined like this. It's at the same level with PayloadContent key. <key>PayloadScope</key> <string>System</string>