VPN always up uses the following XML tag:
<keep_running>1</keep_running>
VPN before logon is currently not supported in FortiClient v5.0 Patch Release 1 (macOS).