I'm running a similar setup (although without IPsec). My compromise was to have name.int.my.domain resolve internally and name.my.domain resolve externally (eas

I'm running a similar setup (although without IPsec). My compromise was to have name.int.my.domain resolve internally and name.my.domain resolve externally (easier with ipv6). dnsmasq should be able to do what you want to do and it can be enabled on the USG - at least from the controller.