Which mode of IPSec should you use to assure security and confidentiality of data within the same LAN?

ESP (Encapsulating Security Payload) provides both confidentiality (encryption) and integrity/authenticity. When used in transport mode, ESP encrypts only the payload of the IP packet, leaving the original IP header intact, which is ideal for securing end-to-end communication between two hosts on the same LAN.

'ESP confidential' is not a standard IPSec mode or option; ESP itself provides confidentiality when used.

AH (Authentication Header) provides data integrity and authentication but does not provide confidentiality (encryption), which is required by the question, and 'permiscuous' is not an AH mode.

AH Tunnel mode, like AH Transport mode, only provides integrity and authentication, not confidentiality. Tunnel mode is also typically used for securing entire IP packets between gateways, not usually for host-to-host communication within a LAN.