[fkbr1]

OK,

what is happening here:

in my configuration all connections to internet are NATed to external FW interface in Hide mode. I guess this is a reason why in Reporter ALL HTTP connections to Internet are reported with "source" as firewall itself. I discovered it by changing "proxy1" and "proxy2" to ANY in my policy. Other protocols which I tested happened to be directed to another subnets without NATing, so they reported with correct source of workstations originated those connections.

Now, why reporter sees "source" of HTTP connections as firewall itself, then in tracker "source" is remaining correct - a workstation (the firewall is loge as "Origin" and not "Source") ! Is it behavior by design ? If so, how can I generate reports on web usage by internal IPs ? If there is somebody who knows, please help.

Thank you
Ali.