Question: why ipsec sa is unidirectional?
Answer: IPsec creates two, unidirectional Security Associations, based upon a single Policy Suite (i.e, set of protocols). ... ISAKMP, for instance, creates a single security association (ie, set of keys within a matching policy suite) that is used to protect data in both directions (bidirectional).