Does device keeps Phase-II SA for sometime after tunnel goes down?

Is it possible to have two Phase I and Phase II connection between peers, in that case traffic will follow which path ?

Phase-I 1 derives three keys, out which 1 Key is used for authentication2 key is used for encryption3 key is used for phase-II keyWhat happens in rekey, how does it generates new key out of one key. It more of maths algorithm question, but still I am...