This reports the maximum number of IPsec security associations that can be established on this managed entity, per its description, with a value of 0 meaning no theoretical limit exists, and it's explicitly unaffected by CLI operations. It's a hard capacity ceiling an admin needs to plan around when sizing how many site-to-site or remote-access tunnels a given platform can support. A router reporting 5000 here that's already running 4800 active SAs is close to hitting a hard wall that would start rejecting new tunnel requests.