We can Process encryption of data at application layer according to given key. So why do we need to use IPSec for security ?
Lets say I want to send message to other machine over internet. Which one is good IPSec or manual encryption ?
TLS was designed to secure only the Application Layer data only. You can use TLS to create a VPN tunnel, but it is not in this way as often.
IPSec/ISAKMP was designed to secure the IP, TCP, and Application Layer data. When using IPSec the IPs are encapsulated with an extra layer of the two endpoints for the IPSec tunnel (VPN), and everything at the Transport Layer and above are encrypted.
Because of the way IPSec encapsulates and secures data it is ideal for large routers. You can route specific network traffic to use the IPSec tunnel across multiple subnets if you wanted to. It also doesn't require special knowledge or a key exchange since the decision to encrypt traffic is made at the IP level of the stack. It does require your network to have already established an IPSec tunnel to reach the services in the remote network. This is ideal for connecting different company campuses' networks together through single points of access.
It's simpler to setup IPsec once between hosts than between every service on your hosts
On a reasonably secure host you should be running several administrative services, like shipping your syslogs to a central server for analysis, same w local system emails, backup agent, HIDS, NTP, SNMP, SSH
Is it simpler to setup ONE encryption/authentication system per machine, or SEVEN?
It's also safer because new connections you make will be secure by default, so when the new Node.js webdev comes in, and connects to your database, he doesn't need to worry about SSL
Some protocols have weak security and will be more secure if over IPsec, like NIS/YP, SNMP, SMTP, NFS
Here's my guide on setting up IPSec between hosts with OpenBSD: