[kazen44]

mind you ipsec in AH mode does NOT encrypt packets. ESP (and thus tunneling) is required for packet level encryption.

your encapsulation argument still holds true however.