IPsec is capable of connecting to a tunnel over IPv4 or IPv6 phase 1 peer addresses, but the tunnel can only contain the same type of traffic inside the tunnel phase 2 definition that is used to pass the traffic outside the tunnel. This means that although either IPv4 or IPv6 may be carried inside of the tunnel, if you want to use IPv6 traffic inside the tunnel, then the tunnel must be connected between IPv6 peer IPs, not IPv4. In other words, the inner and outer address family must match, they cannot be mixed. Mobile IPsec clients do not yet support IPv6.