Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Top Users by Sessions report shows external IP address

I just updated my FortiAnalyzer to v5 and am checking out the various reports. The bandwidth and applications report includes a section Top Users by Sessions. It shows the various internal IP addresses but the top 2 are External. One from Russia (186.x.x.x) and one from Romania (5.x.x.x) I have a Deny rule in place that covers most foreign countries so am concerned as to why these would be showing up here. Thoughts on where to look would be appreciated. Thanks.
Contributor II

On our FAZ200D 5.0.5 all local-in, logged sessions (denied or allowed) are counted and displayed, but no forwarded sessions. On the other hand, forwarded traffic seems to be added to bandwidth calculations, but still only local-in, logged traffic sessions are displayed (i.e. drill-down by bandwidth).