IPv6 has IPsec as a standard feature, though it was backported and so does IPv4. In either protocol, you have to actually configure the two ends to do IPSec negotiations. The Cisco crypto infrastructure is sufficiently baroque that on firewalls I usually prefer to do this from the ASDM GUI interface. I can't speak to routers.
The two ends of an IPsec need to agree on a lot: where they are negotiating, e.g. port 500/UDP; what protocol they are negotiating with, e.g. IKEv1 or IKEv2; how they are authenticating the endpoints, e.g. IP address or x509 Certificates; how a shared secret to protect the phase I negotiations is created; what ciphersuite phase I uses (block cipher, key size, hmac, ...), etc. The phase II negotiations which actually create and destroy the SA's can have separate secrets and ciphersuites. Then there is the question of which traffic takes the IPsec tunnel and which doesn't; on ASA firewalls this is controlled by access-lists identifying either hosts (and optionally ports or protocols) or entire subnets. The complete tunnel spec in the CLI can exceed 100 lines per device.
-- Jim Leinweber, WI State Lab of Hygiene
