Can anyone explain why Phase 1 is bidirectional and Phase 2 is unidirectional in IPSEC VPN. I read in one book that Phase 1 uses shared symmetric key generated by DH and both peers uses same key hence it is bidirectional. Regarding phase 2 two SAs are required 1 for encryption and 1 for Decryption. I thought keys generated in phase1 is also used to encrypt the data in phase 2. If SA is unidirectional then it should have 2 keys(1 for encryption and 1 for Decryption) How phase 2 get 2 different keys?