This counts received Phase-2 exchanges that this device determined were invalid, out of the total tracked by cifIkeGlobalInP2Exchgs, representing malformed or policy-mismatched negotiation attempts rather than successful SA establishments. A rising ratio of invalid to total Phase-2 exchanges points at a specific peer or set of peers sending negotiation proposals this device's IPsec policy can't accept, such as a transform set or proposal mismatch, rather than a general connectivity problem. This is the counter to check first when a specific site-to-site VPN tunnel keeps failing to establish its IPsec SAs even though the underlying Phase-1 (ISAKMP) tunnel itself is up and healthy.