If both ESP and AH are used in a tunnel, each protocol will use different Security Associations (although their SPI numbers may happen to be the same).