I am looking to use my provider Ethernet Connection between our HQ and Branch to do Layer 2 and Layer 3. The Ip addresses I hope to use for the remote are those being advertised to the ISP using BGP. This will help with Internet access. On the other hand, I want the Trust SVR1 and the HQ SVR1 etc to be able to talk to each other. My major problem is "Do I use private IPs, OSPF and VLAN to connect the remote to the HQ over the SP Ethernet (Q-in-Q is allowed)and then route from there. I see this to be a problem since I have to still setup Zoning on the Branch FW. Zones here would include Internet, trust, DMZ. I will also do NAT for the remote and DMZ servers. I am looking for guidance, i can get the commands to implement any suggestions.
You've tagged this post Juniper, so I'm assuming those two Firewalls are SRXs of some variety, in which case - just create Zones for each interface as follows:
HQFW: Internet Zone HQ Server Zone WAN BranchFW: Trust/Branch Server Zone DMZ Zone WAN
Then just write explicit policies (meaning reference Server IPs) to allow traffic between zones. You do not want to extend/tunnel L2 across your Wide-Area Network except in very specific use cases.
Having said all that, the SRX is quite capable of supporting tunnelled L2 as either point-to-point (via L2Circuit-over-MPLS-over-GRE), or multipoint (via VPLS-over-MPLS-over-GRE).
Juniper VPLS example below (uses IPSEC, but this will work fine with GRE once you sort MTU issues):