Each HA pair (active/passive) has 1000 ssl-vpn / cvpn licenses included and it is not possible to assign only 500 and 1500 to another instance. This is because the universal license is bound to the edition of VPX or MPX. You can use 4x single node instance so that you have 4x 1000 ccu 😅