I am exploring using ipsec transport mode to provide secure ipv6 access between 2 LANs and several remote users. I love the combo of a flat ipv6 global unicast address space combined with ipv6 because you can do away with all the routing subnets that are needed for tunnels and vpns. What I don't love is that ipsec transport mode is end to end which would force me to put ipsec policy on servers on my internal lan. Is there some way to terminate ipsec transport at the firewall, and then have the cleartext packets proceed onto my internal LAN?
For reference I currently use OpenVPN for ipv4 interconnection and am tired of dealing with all the extra routing. I've not used ipsec before.