We don't see link down messages in the eventlog on Edge SWG virtual appliance on the Symantec Security Platform (SSP) H/W appliances when SSP's physical I/F link down is detected.
This is expected.
The Edge SWG virtual appliance is a virtual machine and has a virtual interface that is connected to the physical interface. Integrated Secure Gateway (ISG) OS running on SSP currently doesn't have such 'link state propagation' function. This is similar to running a virtual machine on a Broadcom Vmware ESXi host.