IPSec Unidirectional Tunnel!!

[parthrawat979]

I know that Phase-1 tunnel is bi-directional, but what that means?? And why Phase2 tunnel is said to be unidirectional??
I get it that in the show commands for ipsec sa it shows inbound sas and outbound sas, so inbound sas for one peer will be seen as outbound sas on other peer and vice-versa. But what it actually means by a unidirectional tunnel for phase2 and phase1 tunnel as bidirectional.

[julie97cardi]

Hello,

In IPsec, when people say Phase 1 (IKE) is bi-directional, they mean that a single IKE Security Association (SA) created during Phase 1 is used for communication in both directions between the two peers.   zelisproviders com  Once established, that IKE SA allows each side to securely negotiate, manage, and maintain the connection without needing separate “inbound” and “outbound” tunnels—it’s essentially one logical control channel shared by both devices.

[parthrawat979]

Okay, and what about the phase2 tunnel. I don't get why it couldn't be also bi-directional like phase1?? Is there any specific reason for that or is it like that's how the thing worked. 

[M02@rt37]

Hello @parthrawat979 

Phase 1 is considered bi-directional because it establishes a single secure control channel (ISAKMP/IKE SA) that both peers use to negotiate and manage the VPN in both directions, whereas Phase 2 is unidirectional by design ... because it creates separate SAs for each trafic direction ; one SA for outbound traffic and another for inbound. Each with its own keys, sequence numbers. 

[parthrawat979]

So, there's no science behind this? It's just by design that both the phase2 tunnel is unidirectional.

[M02@rt37]

Yes sir !

[parthrawat979]

I just read somewhere:

IPsec creates two, unidirectional Security Associations, based upon a single Policy Suite (i.e, set of protocols). The only thing that makes one IPsec SA different from the next, are the secret keys used within the specific protocols.
This is by design. This way, if someone successfully brute forces one set of keys, they can only decrypt the data in one direction. 
I didn't get the part where the sa's differs from each other.