default or selected kernelversion does not have config value CONFIG_IP_NF_MATCH_AH_ESP.
Result is shown for kernelversion 5.4.123

AH/ESP match support

modulename: ipt_ah.ko

configname: CONFIG_IP_NF_MATCH_AH_ESP

Linux Kernel Configuration
└─>Networking support
└─>Networking options
└─>Network packet filtering (replaces ipchains)
└─>IP: Netfilter Configuration
└─>AH/ESP match support
In linux kernel since version 2.6.12  
These two match extensions (`ah' and `esp') allow you to match a
range of SPIs inside AH or ESP headers of IPSec packets.

To compile it as a module, choose M here. If unsure, say N.

source code: