One caveat about Linux "native IPSEC" (the 2.6 kernel stuff), is that it is broken when the IPSEC endpoint is also a NAT gateway. Eg. single machine as firewall, NAT, and IPSEC gateway -- No issues with ESP, but "transport mode AH" doesn't work at all.

There are patches for this, though, which fix the problem. But who uses "transport mode AH" over the internet, anyway??

Cheers