We have seen a similar thing happen on upgrade before but we could never reproduce it even with the same customer configuration. The IP is taken from the 'interface' selection on the IPsec Phase 1 settings. On 2.0.x, the vip "interface" names were different (vip1, vip2, etc where the number is the VHID), and on 2.1 the names changed to intX_vipY where the VIP interface (e.g. em0, fxp1, vr2, etc) is a part of the name. The code to rename the interfaces in the config.xml data during the upgrade must not have properly translated the old names to the new names.