IPsec security associations are unidirectional by design; to protect traffic in both directions you need multiple SAs.

• A. True
• B. False
• C. Not applicable
• D. Sometimes

Answer: (A)

IPsec security associations are unidirectional, meaning each SA protects traffic in a single direction—from one endpoint to the other—using a specific set of parameters (SPI, encryption, integrity, mode, keys). To have protection for traffic traveling in the opposite direction, a separate SA is required with its own SPI and keys. In practice, a pair of SAs is used for a bidirectional tunnel: one SA handles traffic from A to B, and another handles traffic from B to A. If there are multiple tunnels or peers, you’ll have additional SAs, but the core idea is that each SA covers only one direction, so bidirectional protection needs SAs for both directions.