This is a 64-bit performance counter recorded in a flow's history bin that tallies frames discarded because they matched a deny rule in the network-to-access (n2a) direction access control list. A rising count here tells an admin that traffic flowing from the network side toward the subscriber/access side is being blocked by an ACL, which could mean either the security policy is working as intended or that a misconfigured rule is dropping legitimate downstream traffic. For example, if a technician notices cmFlowHistoryACLN2ADrop jumping right after a new n2a ACL rule was pushed to a flow, they would review that rule to confirm it isn't blocking wanted downstream traffic.