The desc explicitly states this is the count of IPsec unknown SPI errors — received packets referencing a Security Parameter Index this gateway doesn't recognize as belonging to any active SA. This is one of the most diagnostic IPsec error counters, since it specifically means the peer is using an SA the local gateway believes doesn't exist, a classic symptom of the two ends' SA databases going out of sync after one side reboots, rekeys, or has its tunnel reset while the other side keeps sending under the old SPI. e.g. cpvSaUnknownSpiErr spiking right after a peer gateway rebooted and came back up using freshly-negotiated SPIs that briefly overlapped with stale traffic still arriving referencing pre-reboot SPIs.