Sorry for the delay in getting back to you.
IPSec will only encrypt IP packets, so you need to encapsulate the X25 into IP of some sort. That can be GRE, or you should be able to do it just with XOT. Not sure if the XOT router can also be the IPSec endpoint, never tried it (I doubt anyone has), but after it's encapsulated by the XOT router any other routers in between the two XOT endpointsshould certainly be able to encrypt this with IPSec. Your crypto ACL would just be set up to encrypt all IP traffic between the two XOT endpoints.
