I wonder if this would work..  please try in a lab first or in GNS3..switchip routingip vrf wirelessrt 1:1ip vrf usersrt 1:2ip vrf printersrt 1:3int vlan 1ip address 10.0.1.1 255.255.255.0ip vrf forwarding wirelessno shutint vlan 2ip address 10.0.2.1...

Since your running ebgp.. can you just have a second /30 for the second uplink, and stick to routed interfaces?

Is this ipsec over the internet? or do you have an mpls provider?When i worked for an MPLS provider we used a 'multiple default route' sinareo which utilized communities in BGP and route maps to determine which site was the hub.  when one went down,...

Are all of the sessions originating from the internet?