A network engineer must connect two branch offices over the public Internet. The requirement is that the entire original IP packet — including the internal source and destination addresses — be encrypted and hidden from anyone observing the traffic between the two site gateways, and that the gateways handle the encryption on behalf of all hosts behind them. Which IPsec configuration best satisfies these requirements?