FSSO for SSL VPN via syslog

Hello,

I'm configuring FSSO for SSL VPN via syslog. I configured the environment and I can see the logged user on the Fortigate. I have a strange behavior with the IP address showed by the firewall under User and Devices. It is the IP of the domain controller instead of the ip address of the VPN client.

I'm on 7.2.8 version.

The collector is installed on one of my domain controller and it is configure in DC agent mode.

The agent is installed in all domain controllers.

How I can investigate about this problem? I think there is a misconfiguration.

Thank you.