Hello,

What is the best way to create encrypted tunnel on CCR1009?

1) IPsec in tunnel mode (IP->IPsec)
2) IP Tunnel + IPsec (Interfaces->IP Tunnel)
3) GRE Tunnel + IPsec (Interfaces->GRE Tunnel)
4) ...some other?

i need maximum throughput, minimum latency, minimum cpu usage, minimum header overhead.

If it is just 1 tunnel it wont impact performance on a CCR1009 so you can use any method you prefer.
The more you "stack" the tunnels the more overhead you create in terms of MTU and CPU usage, going for the simplest option is usually the best way. Also i believe the 1009 has hardware acceleration for IPsec so i personally would go with that.