Hello,

We need client-server (active-passive) settings for IPIP or GRE tunnels.

Configure them manually and you can set that.
In the "quick IPsec config" in the tunnel interface you just ask for some default settings, when these
are not OK remove the IPsec secret and create the correct rule under IPsec policies and peers.

Client-server version of GRE is called PPTP. I mean, either you have public addresses on both sides, then you can set up static tunnel and any passive mode does not make much sense. Or you don't and then you need some way to authenticate the client, you can't just establish tunnel randomly with anyone who asks.