Ron

There might be something in your requirements or in your environment that we do not yet know that might change this. But in general you should be able to allow traffic going out the outbound interface to the Internet as well as VPN traffic to a remote peer without needing a second IP address.

You would need to be careful with the access list which defines traffic to be protected by the IPSec VPN so that only traffic that is really going to the remote peer is processed by VPN and the other traffic just exits the outbound interface (doing NAT I assume).

HTH

Rick