I know that SSL/TLS authenticates the identity of a server (and/or client) by presenting a certificate which the client sends to a CA to check the validity. This happens before the SSL/TLS connection is made, so the client knows if it is actually communicating with the entity it meant to contact.
From what I understand, IPSec uses the Authentication Header to ensure the messages are coming from the same source with which the IPSec 'connection' was initiated. (I know it is not actually a connection, but I'm not sure how else to call it). This tells the client it is communicating with the same source, but it does not actually identify the source, does it?
Does IPSec have a way to authenticate the identity of a server before establishing the IPSec 'connection'?