Is it possible to encrypt multicast messages with ipsec?

I have tried using:

spdadd 10.4.0.7 231.0.0.1 any -P out ipsec esp/transport//require;
or
spdadd 10.4.0.7 10.4.0.8 any -P out ipsec esp/transport//require;

On the 10.4.0.8 target I have a route from 10.4.0.8 -> 231.0.0.1. When I configure with setkey the messages are 
transmitted, but they are not encrypted.

It says on the setkey man page, that the uppersec parameter doesnt support forwarding, is creating a route treated as a 
forward?

Thanks,
--H