IPsec is optionally used between eNodeB (especially running on unsecured backhaul, e.g. Femto etc) and EPC for security purposes and to prevent any attack on the EPC nodes.
Although the eNB and SGW/MME in the EPC network may support an IPSec tunnel, typically IPSec Gateway element is introduced, in which case the IPSec tunnels from eNodeB terminate at IPSec Gateway. This resolves the scalability issue as the number of tunnels are likely to be large and also will help in not loading the EPC nodes with IPSec processing. Typically three subtunnels are established, which are S1-MME, S1-U, and O&M traffic.
Lastly I think IPSec is not used between UE and it's Peer UE. In fact most of the UEs available today don't support IPSec.