Now that we use XFRM under the hood, there is no technical constraint that a single tunnel must map to a single VTI (XFRM) interface. It is perfectly possible to bind multiple tunnels to one interface, either for redundancy or to reduce administrative overhead with several tunnels each configured with non-overlapping traffic selectors.

Scope of work:

1. Allow the local and remote traffic selectors to be configured when VTI is in use. This may have value on its own, e.g. if users want to change the default of all IPv4 and IPv6 traffic.
2. Modify ipsec hooks that translate tunnel up/down into interface up/down to logically handle multiple tunnels bound to one interface.