using marking and VTI, map two IPsec SA's onto one VTI device using vti-shared=yes