0

Time to time IPSec tunnel status become down, with unusual SNMP Traffic. when I disable and enable port manually, it become normal.

I am using 200E fortigate firewall.

Have you any idea or previous experience with this issue? enter image description here

|improve this question

closed as off-topic by schroeder♦ Dec 31 '18 at 8:25

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • This is a duplicate of your other question and this also is not a security question. – schroeder♦ Dec 31 '18 at 8:26
0

Unfamiliar with that particular unit, but throwing an SNMP trap on an interface up/down is not abnormal if the firewall itself is monitored with SNMP. It could also be LAN side hosts throwing the SNMP as a notification of timeout because of the tunnel outage.

Best bet is to get a sample and take a look. If it is a complex network, it probably isn't malicious. The other thing might be to run a ping monitor of your choice of the remote public interface, just to verify that the tunnel up/down is happening because of a layer 3 problem. Which it probably is, and examining the logs of the firewall will likely confirm that.

Just a few thoughts.

|improve this answer
  • 1
    I can't do anything with remote interface because it is located in separate network in different country. No Special firewall logs found, because once it unusual traffic is started, ip sec become down. our network is not too complex and this interface dedicated for ipsec tunnel. when i interface down and up manually it become normal. – serverAdmin123 Dec 31 '18 at 3:58
  • 1
    So the SNMP is on your end right? If so you should be able to get the packets with a protocol analyzer, (probably built into your firewall) and look at them. Get the RFC for SNMP, and if the packets look properly formatted, it isn't a problem. This is not likely to be causing the interface bounce, but rather is a symptom of the interface bouncing. – James Aanderson Dec 31 '18 at 4:33
  • yes.We have to use separate protocol analyser with this device. Thanks for your idea, i will check it. – serverAdmin123 Dec 31 '18 at 5:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.