IPSec tunnel mode can only be used when the datagrams are:

A.
Sourced from and destined to IPSec systems.

B.
Sourced from and destined to non-IPSec systems.

Explanation:
Tunnel Mode is used to protect datagrams sourced from or destined to non-IPSec systems (such as in a Virtual Private Network (VPN) scenario).