If this was an R80.20+ gateway, I'd surmise that the gateway updated itself with a new IPS signature but the management server didn't have that same IPS update, and therefore the SMS didn't know what to label the protection as in the log. Might not hurt to manually update your IPS signatures on the SMS.
The zero bytes sent and received may just indicate that the three-way TCP handshake never completed, as I believe those byte counters only consider data/payload bytes that appear once the handshake is complete. Is there MySQL actually listening on port 3306 at the destination IP shown in the log?
If I had to take a wild guess, I'd say it is probably the "MySQL General Settings" IPS signature since it has a "See Details..." configuration hyperlink similarly to the oddball "Core Protections" even though it is not explicitly labeled as such. The Core Protections are definitely different to work with and I covered them extensively in my IPS Immersion video course.
On the outside chance this is some kind of log indexer issue, try to locate this log entry using the old-school SmartView Tracker application (CPlgv.exe). Can you see the protection name there?
Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
