A network engineer must connect two data centers over the internet with an always-on IPsec tunnel between two Cisco routers. Requirements are: the tunnel must be treated as a routable Layer 3 interface so that dynamic routing protocols like OSPF can run across it, configuration should avoid crypto ACLs to define interesting traffic, and only these two fixed endpoints will ever participate. Which VPN deployment approach best meets these requirements?