IPsec operates through protocols:
ESP (Encapsulating Security Payload): Provides confidentiality through encryption, plus integrity checking. This is what you'll use % of the time.
AH (Authentication Header): Provides integrity and authentication but no encryption. Rarely used alone since ESP covers both needs.
IPsec can run in modes. Transport mode encrypts only the payload. Tunnel mode wraps the entire original packet inside a new IP header with encryption.