Time to time IPSec tunnel status become down, with unusual SNMP Traffic. when I disable and enable port manually, it become normal.
I am using 200E fortigate firewall.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Unfamiliar with that particular unit, but throwing an SNMP trap on an interface up/down is not abnormal if the firewall itself is monitored with SNMP. It could also be LAN side hosts throwing the SNMP as a notification of timeout because of the tunnel outage.
Best bet is to get a sample and take a look. If it is a complex network, it probably isn't malicious. The other thing might be to run a ping monitor of your choice of the remote public interface, just to verify that the tunnel up/down is happening because of a layer 3 problem. Which it probably is, and examining the logs of the firewall will likely confirm that.
Just a few thoughts.