Combining SAs

• SA can implement either AH or ESP protocol, but not both

• Traffic flow may require separate IPSec services between hosts

• Security Association Bundle refers to a sequence of SAs

• SAs in a bundle may terminate at different end points