
using marking and VTI, map two IPsec SA's onto one VTI device
