From my experience, depends on the equipment that creates the IPSec tunnel and if it is route or policy based.
For route based IPSec tunnels, equipment normally adds it as another interface and you can monitor that directly in MIB2.
For policy based... monitoring something on the far side, like the internal IP of the far end, is probably best. A loopback can work to avoid the false positive of the far end network dropping but the device still up, but in policy based tunnels it is probably more work to create than not and the tunnel is really only useful if there are things talking over it.
I'd just go ahead and monitor the far side. Simple and, if the far side is down in monitoring, you know that the tunnel isn't working (either tunnel down or far side equipment problem; either way the tunnel is not passing traffic).