You're thinking of a GRE/IPsec setup in IOS. With a PIX you just set up the interface to be a point-to-point OSPF interface, then manually define the remote OSPF neighbour (the IPSec peer). You then just add a line to your crypto access-list that includes traffic between the two OSPF neighbours, that way you ensure the OSPF unicast traffic goes over the tunnel.
