The Internet Key Exchange (IKE) protocol establishes a security association (SA) in two distinct phases. The IKE SA, also known as the Phase 1 SA, is created during the first phase of negotiations. Its purpose is to provide a secure, authenticated channel for the subsequent Phase 2 negotiations. A key characteristic of this IKE SA is that it is bidirectional, meaning a single SA handles control traffic in both directions between the two IPsec peers. This is in contrast to IPsec SAs (Phase 2), which are unidirectional.

B: IKE security associations are bidirectional. It is the IPsec SAs, established in Phase 2 to protect data traffic, that are unidirectional.

C: This describes the creation of IPsec SAs. The IKE SA must be established first, during Phase 1, to protect these Phase 2 negotiations.

1. Juniper Networks TechLibrary

"Understanding IKE and IPsec SAs": "The IKE SA is a bidirectional SA that is used for the IKE protocol... In IKEv1

IKE SAs are established in Phase 1." This document explicitly states that IKE SAs are established in Phase 1 and are bidirectional.

URL: https://www.juniper.net/documentation/us/en/software/junos/vpn-ipsec/topics/concept/ipsec-understanding-ike-ipsec-sas.html

2. Juniper Networks TechLibrary

"IPsec Overview": "IKE creates a secure channel for the peers to communicate by negotiating SAs in two phases... Phase 1—The peers establish a secure channel. They authenticate each other and negotiate the way to encrypt further communication... The outcome of a successful Phase 1 exchange is an IKE SA." This confirms the IKE SA is the outcome of Phase 1.

URL: https://www.juniper.net/documentation/us/en/software/junos/vpn-ipsec/topics/concept/ipsec-overview.html