I'd like to do a route based VPN between two sites. The purpose of this is to get remote site traffic passing through a transparent gateway at the headend, instead of using a proxy.
So currently it is straightforward with the policy based VPN in place currently - remote sites have a proxy defined so any internet destined web traffic matches the interested traffic rules because it goes to the proxy.
In the absence of the proxy server, encryption domains cannot be used - the destination network is "everything".
Route based VPNs use a GRE tunnel ordinarily so the default route can be the tunnel, and everything gets encapsulated in the tunnel which is part of the encryption domain. However, the remote site has an IOS router, and the headend is an ASA. So there does not appear to be any way to create a tunnel between them.
I have explored terminating the GRE tunnel on the core switch at the headend, however it is a 3750 - the feature set does not include gre tunnels, and even if it did, gre is switched on the CPU apparently so can suffer/cause performance issues.
So beyond changing hardware out, can anyone suggest a way to allow remote sites to access the internet over an IPSec VPN without needing a proxy server?