A quality that prevents a third party from being able to prove that a communication between two other parties ever took place. This is a desirable quality if you do not want your communications to be traceable. Non-repudiation is desirable if you want to be able to trace your communications and prove that they occurred. It includes such things as the transform and the shared secret keys to be used for protecting the traffic. The IPSec security association is established either by IKE or by manual user configuration.
Security associations are uni-directional and are unique per security protocol.
If the security associations are manually established, they are established as soon as the necessary configuration is completed and do not expire. A security gateway is an intermediate system that acts as the communications interface between two networks. The internal subnets and hosts served by a security gateway are presumed to be trusted by virtue of sharing a common, local, security administration. This is a number which, together with a destination IP address and security protocol, uniquely identifies a particular security association. When using IKE to establish the security associations, the SPI for each security association is a pseudo-randomly derived number.