On the SIP level, there are three headers that are of importance for the setup of these security associations. These are the Security-client, Security-server and Security-verify headers.
IP Seq used two protected ports, each are negotiated between the UE and the P-CSCF for all subsequent signaling traffic.
The IPSec is in tunneled mode between the UE and P-CSCF.
Between network nodes (P/I/S-CSCFs), IPSec is in transport mode.