The desc explicitly states this is the IPsec current Inbound AH SAs — AH (Authentication Header) provides integrity and authentication without encryption, an older and rarer IPsec mode than ESP. Because most modern Check Point VPN deployments use ESP exclusively, this legitimately staying at zero is normal and not itself a problem; a nonzero value specifically indicates a peer or policy configured for the AH protocol rather than ESP, worth knowing since AH doesn't encrypt payload data. e.g. cpvCurrAhSAsIn = 0 on most gateways, or a small nonzero count if one legacy tunnel was specifically configured to use AH for compliance reasons.