IPSec tunnel mode can only be used when the datagrams are:
A.
Sourced from and destined to IPSec systems.
B.
Sourced from and destined to non-IPSec systems.
Explanation:
Tunnel Mode is used to protect datagrams sourced from or destined to non-IPSec systems (such as in a Virtual Private Network (VPN) scenario).