pfSense can do IPSec VPN, so if you're not tied to particular hardware it may be worth just using the pfSense box.
Where to put it, only you can really answer that as it depends on whether you trust the far end of the IPSec VPN or not

Assuming you do, stick it behind the pfSense box and tell the pfSense box to foreward ESP and 500/UDP. Of course, that may not work (technical limitations) and you may have to put it on front of the pfSense box.