The desc explicitly states this is the IPsec max concurrent Inbound ESP SAs, the highest value cpvCurrEspSAsIn has reached since startup. This high-water mark is the number to compare against any per-gateway IPsec SA capacity limit, a real constraint on some Check Point appliance models or licenses, so a trend toward a known ceiling is a capacity-planning flag before new tunnels start failing to establish. e.g. cpvMaxConncurEspSAsIn = 40 reached during a period when several remote-access VPN users connected simultaneously alongside the permanent site-to-site tunnels.