Internet Protocol Security IPSec is actually a suite of protocols. Each protocol within the suite provides different functionality. Collective IPSec does everything except.

IPSec does protect both headers and payloads - in tunnel mode the entire original IP packet (header and payload) is encapsulated by AH or ESP.

IPSec does provide authentication through the Authentication Header (AH) protocol and through the IKE key exchange process.

IPSec does provide encryption through the Encapsulating Security Payload (ESP) protocol using algorithms such as AES.

IPSec operates at the Network Layer (OSI Layer 3), encapsulating and protecting IP packets. The Data Link Layer (Layer 2) is the domain of protocols such as Ethernet, PPP, and 802.11 - IPSec has no functionality at that layer.