Only cache data as needed (e.g. traffic selectors only for forward policies) and at most once for each IPsec SA.