Hi,

I thought of evaluating firewall analyzer to see if this can be beneficial for us. The setup seems to go fine and I am getting report from 2 of the firewalls I configured. One our main firewall when I go for top user report (traffic report - top user sent, receive or sent + receive), I am seeing one external IP as a top user.

If I select this entry, I do not see any info except for this IP address. Also I do not see any thing about this IP in either the debug or information log in the firewall analyzer. I also trying monitoring live log on the ASA, but I have never found a entry for this IP there too (tried all sort of search).

Any idea whats going on here?