With ESP, the entire packet is encrypted, including the packet payload that contains the sensitive data being transmitted. With AH, nothing is encrypted. Instead, a copy of the packet is created to ensure that it is not modified during transmission. But AH is faster. AH does not require encrypting the packet, so the VPN takes less time to respond to user requests.
Transport mode secures an existing IP packet from source to destination.
Tunnel mode puts an existing IP packet inside a new IP packet in the IPsec format. Both transport and tunnel mode can be encapsulated in ESP or AH headers. IKE is a key management protocol designed for the secure exchange of encryption keys used by other encryption and authentication schemes. 3DES and SHA-1 provide higher levels of security, but using 3DES may slow VPN response time because it requires a lot of processing power to encrypt and decrypt data. IKE is the framework that negotiates security association and keys, allowing each end of the connection to authenticate itself to the other and establish shared keys.