Our IDS shows each day about 20 nachi alarms orginating from the private ip address of our 3015 vpn concentrator and I'm at a loss to explain it.
This occurs regardless of clients being connected or not. ICMPs are filtered and dropped both in and outgoing on the box.
The IDS signature shows the nachi alarms as coming from and to port 0, which also seems strange.
Does anyone know what could be causing this?
Btw we are running 3.x of IDS - have yet to upgrade to 4.x
