srcname field always showing the same value with different IP addresses

[Belgarioz]

Hello,

I have opened a ticket to TAC for this issue but things are going slowly with them

A customer of mine noticed the raw logs of client traffic is always show the same value: a weird ONEBOX51 associated a different IP addresses.

What I can say is that behind the Fortigate is connected a Core Stack Layer 3, so all the traffic comes from the same MAC address. In fact, device detection doesn't work properly because of it.

I am asking is the srcname field related to it? How does exactly work srcname? I googled around and haven't found anything about FAZ field explanation.