A network engineer is configuring a site-to-site IPsec tunnel between two data centers to carry sensitive financial replication traffic over the public Internet. The security policy mandates that the payload be both encrypted and integrity-protected, and the tunnel must survive traversal through an intermediate NAT device. Which IPsec protocol should the engineer select for the transform set to meet these requirements?