How to process IP packets with ESP is decided by process mode of ESP itself. To ESP, encrypted packets are authenticated while authenticated packets are not encrypted, that is, outgoing packets are firstly encrypted while ingoing packets are firstly authenticated.