One of the reasons ipsec is tricky to understand is it doesn't create virtual interfaces like most other vpn systems on linux. With something like openvpn you can run tcpdump on eth0 / tun0 to figure out what is going on. With ipsec there's no 'ipsec0' interface and the way it works is a little more 'magic'.