how to setup ipsec vpn behind the firewall

A firewall is easy allow protocol 50 and UDP port 500. Likely it will not be that simple if you are running NAT someplace or if you are trying to establish multiple ipsec session from behind a single nat ip. That though is not a firewall issue it is related to NAT