IP Security and Hardware Encryption

The io-pkt-v4-hc and io-pkt-v6-hc stack variants include full, built-in support for IPsec.

Note: You need to specify the ipsec parameter option to the stack in order to enable IPsec when the stack starts.

There's a good reference page in the NetBSD man pages covering IPsec in general. There are some aspects that don't apply (you obviously don't have to worry about rebuilding the kernel), but the general usage is the same.