The desc explicitly states this is the count of Fwz encapsulated encrypted packets — packets encrypted using Check Point's legacy proprietary FWZ VPN protocol that were also encapsulated, wrapped in an additional IP header the way IPsec tunnel mode is, so they can traverse NAT and routing. FWZ is Check Point's own pre-IPsec-standard VPN protocol, largely obsolete in modern deployments in favor of IKE and IPsec, so a nonzero value on a current gateway most likely means it is still maintaining a legacy VPN community with an old peer that hasn't migrated to IPsec, worth flagging as a migration candidate rather than treated as routine traffic. e.g. cpvFwzEncapsEncPkts showing steady but low traffic from one remaining legacy branch-office gateway still running an old software version that predates full IPsec adoption.