What are the best practices for running an IGP to learn networks at HQ from branch offices when those offices connect via IPSec LAN-to-LAN VPN tunnels over the Internet? The branch offices terminate on Cisco VPN Concentrators that are being replaced with Cisco ASA-X's.
Is it better to let a dynamic routing protocol (IGP) -- in this case OSPF -- run directly through or to the firewalls (and across the tunnels) or is OSPF over GRE (through the firewalls, but not to the firewalls) the way to go or some other option? We have too many static routes in place that need to be eliminated. The IPSec VPN branch offices are small and don't currently run an IGP other than statics, so consider it a clean slate on what to do with branch office routing. Routers exist beyond the firewalls and can be used for tunneling if needed.
*Answers should focus on Cisco ASA-X's in the mix with L3 switches behind them to run any GRE tunnels if necessary.