As you deploy a Palo Alto Networks firewall, the IPSec tunnel configuration allows you to authenticate and/or encrypt data (IP packet) as it traverses across the tunnel.
Head here for step-by-step instructions in the PAN-OS 6.1 Administrator's Guide.
And while you're at it, be sure to check out 9 New Features and Topics to Check Out in PAN-OS 6.1.