Integrity protection in IPSec VPN GW

Hello,

I heard that IPSec VPN GW provides only confidentiality 
service and doesn't  provide integrity protection.

This sounds a bit strange to me as integrity and origin authentication 
service is defined for IPSec ESP.

Does it mean that current VPN GW products doesn't support this or does 
that means that this support is thefre but requires heavy keying infra so 
in practice VPN deployment only confidentiality protection is supported?

Can someone in the list give me some clarification on this?

Thanks,
Son