How to organize Internet access from remote Mikrotik points?

Question

Mikrotik

Good afternoon.
Is available there is an office 1, office 2, office 3.
In office 1 there is a gateway with Kerio Control.
In offices 2 and 3, there are Mikrotik RB2011UiAS-RM that cling to Kerio via Ipsec
The task is as follows: It is necessary that one user, while in office 2, be able to access the Internet under the ip of office 3.

Answer 1

Establish an ipsec tunnel between offices 2 and 3. Configure PBR. Profit!

Answer 2

IPSec transport or tunnel?