diff --git a/res/layout/vpn_dialog.xml b/res/layout/vpn_dialog.xml
index 620b43fcfab..6822e954189 100644
--- a/res/layout/vpn_dialog.xml
+++ b/res/layout/vpn_dialog.xml
@@ -119,8 +119,7 @@
         <LinearLayout android:id="@+id/login"
                 android:layout_width="match_parent"
                 android:layout_height="wrap_content"
-                android:orientation="vertical"
-                android:visibility="gone">
+                android:orientation="vertical">
 
             <TextView style="@style/vpn_label" android:text="@string/vpn_username"/>
             <EditText style="@style/vpn_value" android:id="@+id/username"/>
diff --git a/src/com/android/settings/vpn2/ConfigDialog.java b/src/com/android/settings/vpn2/ConfigDialog.java
index a13e29dbad5..92050e92fbb 100644
--- a/src/com/android/settings/vpn2/ConfigDialog.java
+++ b/src/com/android/settings/vpn2/ConfigDialog.java
@@ -170,6 +170,9 @@ class ConfigDialog extends AlertDialog implements TextWatcher,
             // Show type-specific fields.
             changeType(mProfile.type);
 
+            // Hide 'save login' when we are editing.
+            mSaveLogin.setVisibility(View.GONE);
+
             // Switch to advanced view immediately if any advanced options are on
             if (!mProfile.searchDomains.isEmpty() || !mProfile.dnsServers.isEmpty() ||
                     !mProfile.routes.isEmpty()) {
@@ -188,9 +191,6 @@ class ConfigDialog extends AlertDialog implements TextWatcher,
         } else {
             setTitle(context.getString(R.string.vpn_connect_to, mProfile.name));
 
-            // Not editing, just show username and password.
-            mView.findViewById(R.id.login).setVisibility(View.VISIBLE);
-
             // Create a button to connect the network.
             setButton(DialogInterface.BUTTON_POSITIVE,
                     context.getString(R.string.vpn_connect), mListener);
@@ -259,6 +259,7 @@ class ConfigDialog extends AlertDialog implements TextWatcher,
     public void onCheckedChanged(CompoundButton compoundButton, boolean b) {
         if (compoundButton == mAlwaysOnVpn) {
             updateSaveLoginStatus();
+            getButton(DialogInterface.BUTTON_POSITIVE).setEnabled(validate(mEditing));
         }
     }
 
@@ -318,6 +319,9 @@ class ConfigDialog extends AlertDialog implements TextWatcher,
         if (!editing) {
             return mUsername.getText().length() != 0 && mPassword.getText().length() != 0;
         }
+        if (mAlwaysOnVpn.isChecked() && !getProfile().isValidLockdownProfile()) {
+            return false;
+        }
         if (mName.getText().length() == 0 || mServer.getText().length() == 0 ||
                 !validateAddresses(mDnsServers.getText().toString(), false) ||
                 !validateAddresses(mRoutes.getText().toString(), true)) {
@@ -441,7 +445,8 @@ class ConfigDialog extends AlertDialog implements TextWatcher,
                 break;
         }
 
-        profile.saveLogin = mSaveLogin.isChecked();
+        final boolean hasLogin = !profile.username.isEmpty() || !profile.password.isEmpty();
+        profile.saveLogin = mSaveLogin.isChecked() || (mEditing && hasLogin);
         return profile;
     }
 }
diff --git a/src/com/android/settings/vpn2/ConfigDialogFragment.java b/src/com/android/settings/vpn2/ConfigDialogFragment.java
index fc49fd86cf4..5e4a7d97258 100644
--- a/src/com/android/settings/vpn2/ConfigDialogFragment.java
+++ b/src/com/android/settings/vpn2/ConfigDialogFragment.java
@@ -152,12 +152,9 @@ public class ConfigDialogFragment extends DialogFragment implements
                 return;
             }
 
-            // Update only if lockdown vpn has been changed
-            if (!VpnUtils.isVpnLockdown(profile.key)) {
-                final ConnectivityManager conn = ConnectivityManager.from(getActivity());
-                conn.setAlwaysOnVpnPackageForUser(UserHandle.myUserId(), null);
-                VpnUtils.setLockdownVpn(getContext(), profile.key);
-            }
+            final ConnectivityManager conn = ConnectivityManager.from(getActivity());
+            conn.setAlwaysOnVpnPackageForUser(UserHandle.myUserId(), null);
+            VpnUtils.setLockdownVpn(getContext(), profile.key);
         } else {
             // update only if lockdown vpn has been changed
             if (VpnUtils.isVpnLockdown(profile.key)) {