The concurrent SSL connections graphs shows the client side connections such as VPN Tunneling (Network Connect or Pulse Secure Desktop client), WSAM, JSAM. Even if you select ESP mode, it would be counted as SSL as connection is SSL and only the data channel uses ESP. KB16841 - Differences between Concurrent Users and Concurrent SSL Connections graphs
... View more