According to the author, IOS makes new connections outside of the tunnel after the VPN was enable. There is no effective workaround.