A firewall reporting healthy doesn't mean the tunnel it's terminating is up. Here's how to alert on tunnel state specifically.
Most enterprise firewalls (FortiGate, Palo Alto, ASA) expose IPsec tunnel up/down status through vendor-specific MIB extensions or their API, separate from basic interface state.
A device that's reachable but has a tunnel down is a different, often more urgent, problem than a device that's unreachable outright: traffic silently stops flowing to a specific site instead of a clear device-down alert.
A tunnel that repeatedly drops and re-establishes (often an MTU, rekey-interval, or unstable-uplink issue) can be worse for applications than one clean outage, and it's worth a distinct alert for flap count over a rolling window.