Trialing Software... I like it so far but one major issue.

Hi,

I've downloaded the 30 days trial and so far I like the software. It is quite nice.

However my "intranet" reports don't seem to be reporting what I would expect.

I have an ASA runn 8.0 code. I am sending my syslog traffic from the inside interface. I have configured my intranet settings as

Networks :
Net :192.168.0.0 Mask :255.255.0.0

I set this a few hours after the firewall started sending logs, however this was a few days ago.

Looking at the Intranet logs from today only

Top Internal Hosts (Sent + Received)

10.11.11.3   251 14.92 0 14.92
151.119.121.95   58 4.91 0 4.91
DEVINSIDE   180 2.01 0 2.01
151.119.132.129   2 0 1.23 1.23
120.18.141.63   5 0.03 0 0.03
192.168.1.170   20 0.02 0 0.02
192.168.1.169   20 0.02 0 0.02
MAILINSIDE 64 0.01 0 0.01
202.53.150.171   3 0.01 0 0.01

NOTE: The 10.11.11.3 address is an assigned remote IPSec address.

As you can see there are hosts here which are clearly not part of our intranet... is this correct?

What could be causing this?

Could it be because of the delay between recieving logs and when I confugred the intranet it "learned" these external IPs as internal IPs?

Please assist. I want to use this product, but if this cannot be resolved I will have to look elsewhere.

Many thanks.