...to provide for IPsec tunneling. Since some VoIP endpoints are not computationally powerful enough to perform encryption, placing this burden at a central point ensures all VoIP traffic emanating from the enterprise network has been encrypted...
http://www.netclarity.net/NC-VoIP-Whitepaper.pdf