For every interesting traffic flow in VPN or every crypto ACL a corresponding IPSEC SA is configure where in PROXY identities implies local and remote identites which in turn provide detail of interesting traffic between local network and remote network which will be encrypted over the tunnel.
Now how this traffic flows is that it depends upon the IPSEC SA, for each traffic flow corresponding IPSEC SA is built for encryption as well as decryption. This is why we see two IPSEC SA for one proxy identity.
These SA's as refeshed after a specific interval i.e. after rekey and then new SA's are created. These SA's are dependent upon the VPN context IDs and usage data IDs that are deleted and created everytime after rekey. For checking this out you can use command "show asp table context" and "show asp table classify crypto".
Whenever any packet fails to encrypt or decrypt due to any random reason then we should be able see errs in IPSEC SA.
Regards,
Anuj
