Cisco 2911 with SLA controlling the default route between a primary ISP A interface and a failover secondary ISP B interface.  I wish to allow PPTP VPN connections to the router on either interface, but the local router traffic responding to attempts...

Following the many samples to be found online for setting up Site-to-Site ISAKMP-IPSEC over VTI I can perform a show crypto ipsec sa and get the output below. My question is why the second unused entry appears for the local/remote idents 0.0.0.0 ?   ...