Ken
You are not required to purchase the VPN hardware module to be able to do IPSec. If you have a feature set that supports IPSec you can do the IPSec encryption and decryption in software. Note that this puts additional load on the processor and does not scale well if the amount of IPSec traffic increases. The hardware module relieves the processor of the encryption and decryption processing and is an advantage if you want to do greater amounts of IPSec. But it is not a requirement for doing IPSec.
HTH
Rick
HTH
Rick