We have recently downloaded the trial package of FA and have configured it to log and analyse traffic from our Juniper Firewall. This is all working fine, except the traffic analysis only appears to be processing traffic from the trust network.

We were looking to FA to provide analysis of external attack etc. 

The raw sys logs contain traffic for all zones, but the traffic logs only appear to contain information on the trust network. 

Is this a configuration issue or is FA designed to monitor internal traffic?

Many Thanks

Roger