We are currently testing Palo Alto FW user-id feature which is collecting data from our ISE deployment via Radius Accounting syslogs. Interestingly, the PA FW is reporting 90-95K user-id information BUT our active sessions in the dashboard and API call is reporting over 130K. Wondering what is the difference between both, I could not find much information from my research. thanks