The media-gateway ip command defines the IP address to and from which the device will send voice packets. Where you put it depends on the nature of your failover setup. If you have a loopback interface that is properly routed over both the primary and backup WAN, then specify that loopback as the media-gateway IP on all of the egress interfaces. This has the advantage of keeping SIP registrations and call flows intact when a failover occurs, except for a brief delay as routing to the loopback reconverges.
If, on the other hand, you have two different ISPs with different subnets and you can't maintain the same outside-facing IP address during a failover, then use media-gateway ip primary on both. This means that calls will drop and SIP registrations will need to refresh when a failover occurs (and when it restores). Obviously the other end of the connection must be capable of reaching both the primary and backup IP and not firewalled from either.
With a tunnel, you could use a loopback or the tunnel interface itself provided that the IP assigned to the media gateway is reachable and configured for VoIP on the other side.
Short version: Every outside-facing IP-enabled interface used for voice needs a media-gateway ip statement, either primary if that interface itself is to be used or a loopback if that is to be used.
Inside-facing ones need it as well if there are SIP phones on the inside. If just analog and PRI on the inside, then the WAN side is all you need to worry about.
