On IPSec protocol, how can denial of service (DoS) be prevented or its effect be minimized? For example, assume an attacker intercepts a packet and changes its sequence number to a bogus one (say 10 is changed to 100000). This will make the receiver slide the anti-replay window so far that real packets will be drooped (regarding them as being old) thereby denying them service. How can such attack be prevented on IPSec protocol? Thanks.
The situation you're describing isn't specific to IPSec. If the attacker is in position to modify packets in-flight between two hosts, then his ability to deny service between those two parties in question can't be mitigated.
The solution is to either find the perpetrator (he shouldn't be hard to find given that he has to be along the path between the two hosts), or move an endpoint to a more secure location.