As an improvement you can do ipsec without manually configurating the crypto maps (which is a pain the .... if you ask me) by using ipsec profiles. Here is an example:
Start by creating an isakmp policy:
crypto isakmp policy 1
encryption <whatever encryption you need e.g. aes or des>
hash <sha or md5>
authentication <whatever authentication you want e.g. pre-share or rsa-sig if you have a digital certificate for the router>
group <diffie-hellman group id>
crypto isakmp key <key you want to use> address <corespondent physical interface ip address> [SM-optional] !! you must define the key only if you selected authentication pre-share in the isakmp policy. If, on the other hand, all your routers have valid digital certificates issued by a CA recognized by all of them and you have authentication rsa-sig in the isakmp policy, then you don't need a crypto key. The <key you want to use> should be identical on the corresponding router
You then need to create an IPSec transform-set (TS):
crypto ipsec transform-set <name of the TS> [transform 1 e.g.ah-sha-hmac] <transform 2 e.g. esp-aes 256> [transform 3 e.g. esp-sha-hmac]
!!you don't necessarily need the authentication header (AH) transform, depends on how paranoid you are :P. In most cases the second and the third are enough.
mode <tunnel(default) or transport> !!specifies whether to encrypt the L3 header or not along with the payload, default is ok
Next you need to define an IPSec profile:
crypto ipsec profile <name of the profile>
set transform-set <name of the TS>
Next you need to apply the ipsec profile on the tunnel interface:
interface Tunnel <no of the tunnel>
ip address <IP of tunnel> <SM>
tunnel mode gre !!(this is the default I think)
tunnel source <physical interface e.g. FastEthernet 0/0>
tunnel destination <IP address of the corresponding router physical interface>
ip mtu 1400 !!not strictly needed but good practice to compensate for the additional overhead of the gre encapsulation
ip tcp adjust-mss 1360 !!same as above
tunnel protection ipsec profile <name of the profile>
In the end you need to configure the corresponding router accordingly and there you go, no access-lists and no crypto maps.
For the routing protocol, you only need to ad the ip adresses of the tunnel interfaces to ospf. For the physical interface you can create a static route. Nothing else should be routed directly through the physical interface without being gre encapsulated first.
As for the NAT, you need to research more the order of operations, but in your case i believe the nat is done after the gre encapsulation and ipsec.
