design for ipsec to cisco 2911

Hi All,

I understand that route based tunnels are preferred to policy based policies.

Can I use an ipsec interface tunnel to biuld a link to a cisco 2911 and merely disregard the interface IP addresses?

We will create a tunnel to an external party for remote support and maintenance, see attached diagram. It will be the first such external tunnel. We have been provided with vpn configuration information containing only proposal, DH group and lifetime for both phase 1 and 2, as well as policy requirements.

Tunnel traffic will be only between server 1 and server 2.

Within our networks we use FGT <> FGT ipsec-interface tunnels widely for ospf so I'm very familiar with this configuration.

I hope the following will work:

Create phase1-interface and phase2-interface with settings to match the cisco;

Make no changes to the interface itself (ie in config sys int);

Add a static route for Z via X;

Add a static route for b.b.b.b via the tunnel;

Create the required policies.

Profit, or relax.

Is this correct? Any tricks to keep in mind?

Thanks in advance

[edit: typo]