Top Users by Sessions report shows external IP address

[Randy_Redekopp]

I just updated my FortiAnalyzer to v5 and am checking out the various reports. The bandwidth and applications report includes a section Top Users by Sessions. It shows the various internal IP addresses but the top 2 are External. One from Russia (186.x.x.x) and one from Romania (5.x.x.x) I have a Deny rule in place that covers most foreign countries so am concerned as to why these would be showing up here. Thoughts on where to look would be appreciated. Thanks.

[netmin]

On our FAZ200D 5.0.5 all local-in, logged sessions (denied or allowed) are counted and displayed, but no forwarded sessions. On the other hand, forwarded traffic seems to be added to bandwidth calculations, but still only local-in, logged traffic sessions are displayed (i.e. drill-down by bandwidth).