We will configure the tunnel interface on the router. It is on this interface that the remote user gets connected to.

ISR-LAB(config)#interface Virtual-Template100 type tunnel
ip unnumbered GigabitEthernet1 ## this is your ISP interface
ip mtu 1400
ip nat inside
zone-member security inside ## Every interface on an ISR4000 series needs to be a zone member
ip tcp adjust-mss 1360
tunnel mode ipsec ipv4
tunnel protection ipsec profile ikev2-ipsec-profile