Not distinguishing between inbound/outboand

We have set up the demo of firewall analyzer, and for the most part it appears to be behaving correctly. We have it monitoring Checkpoint firewall using Authenticated LEA, which also works, though there seems to be some significant discrepancies with regard to traffic volumes. The live report does not appear to be accurately reflecting the data.

Also, the traffic related reports show our hosts (behind the firewall) in all of the lists. We have set up the intranet rules with all of the networks behind the firewall. Is it possible that the problem lies in the fact that the firewall performs NAT on some of the hosts? This would obviously change the IP address perceived by firewall analyzer? In any event I added the range of address used for the NAT as well, and still see all of our machines in the reports.

Something is just not quite right.