This counts how many times this device received an Extended Authentication (XAUTH) request from a peer, XAUTH being the older IKE extension that layers username/password-style authentication on top of the standard IKE Phase-1 exchange, commonly used for remote-access VPN client authentication. It's a device-wide indicator of how much legacy XAUTH-based remote-access VPN activity is occurring, useful for gauging whether this authentication method is still actively used before considering deprecating it in favor of more modern authentication. A device supporting mostly site-to-site tunnels, which typically don't use XAUTH, but showing a steadily climbing count here indicates it's also actively serving remote-access clients using username/password authentication.