The desc explicitly states this is the count of IPsec authentication errors — packets that failed the ESP or AH integrity check, meaning the packet's authentication data didn't match. Unlike decryption errors, this specifically flags packets that decrypted but whose integrity check failed, the signature you'd expect from either a corrupted transport path or, more concerningly, active tampering or injection attempts against the tunnel. e.g. cpvSaAuthErr incrementing steadily from an intermediate device on the path that is mangling ESP packets in transit, rather than from any misconfiguration on the gateway itself.