IPSec has many modes but there are two main forms authentication for an IPSec tunnel via Internet Key Exchange (IKE) - IKEv1 and IKEv2 (newer) which support 509.X certificates or even preshared keys (such as passwords); the IKE mode selected will then use diffie-hellman (if it's selected in the config, for example) to exchange a symmetric key (as you stated) for the tunnel session (if that's the mode you are using). At this point you have a matured Security Association (SA). Now that you have a key that you are going to use for the session, IPSec has two protocols that will encapsulate your tunnel, AH and ESP. AH, Authentication Header, provides authentication but no encryption of the tunnel. ESP, Encapsulating Security Payload, uses the encryption algorithm (3DES-CBC, AES-256-CBC, etc...) that you selected in the IPSec configuration to encapsulate the traffic (tcp, udp, icmp, etc...) as it makes its way to the other device that you have the SA with. FYI, some vendors support a mix of ESP/AH protocols.
If you want to know more about IKE and IPSec check out the RFCs, they are really detailed and informative.