I am sure that whatever traffic has source and destination address that match the traffic selector of an IPsec policy gets encrypted by IPsec and delivered to the peer to which that policy is bound to (unless the selector also specifies a particular IP protocol and port(s), which is not your case here). That’s why I’ve written that you must set the IP addresses for the transport packets to be the ones to which the policy refers.