Which statement about IPsec is correct?