GlobalProtect clients logged as PA MGMT
Looking through my logs today and I noticed that connections initiated by clients using GlobalProtect are being logged as sourcing from the PA management interface. Is this expected/intended behavior? Shouldn't the log show the clients IP address?