A Security Association (SA) is a simplex "connection" that affords
security services to the traffic carried by it. Security services
are afforded to an SA by the use of AH, or ESP, but not both. If
both AH and ESP protection is applied to a traffic stream, then two
(or more) SAs are created to afford protection to the traffic stream.
Question 1 : Why are two or more SAs created instead of one when both AH and ESP are used?
Question 2: Why would it be bad to use both AH and ESP for one Security Association?