The desc explicitly states this is the IPsec current Inbound ESP SAs, the number of active inbound Encapsulating Security Payload security associations right now. Each SA here corresponds to one negotiated encryption context with a peer for one direction of traffic, so this count roughly tracks how many peers currently have live inbound ESP protection — a value stuck at zero when tunnels are supposedly up means inbound ESP traffic isn't actually flowing. e.g. cpvCurrEspSAsIn = 14, matching 14 active inbound encryption contexts across the site-to-site tunnels and remote-access clients currently connected.