IPsec tunnel configuration with AAA server authentication

I am very new to AAA and IPSec.

I have aaa freeradius docker running on my local machine (macOs) and somewhere in VM my application is running. My application is authenticating username and password through freeradius docker which is working fine. Now I am trying to introduce IPsec tunnel between my application and AAA server (freeradius docker). I am trying to understand below -

1. Where to configure IPsec tunnel? on the VM where my application is running? Or is it a different VM where I need to configure IPSec?
2. How to activate IPsec for AAA server (freeradius docker) or how can pass communication through IPsec before reaching to AAA server?

Any documentation or example related to this will great help on it.