Hello Geovanny,
Is this production environment or lab?
What kind of traffic passing through the SCE?
(Num of flows, src IPs, TCP/UDP, applications, etc.)
One possible explanation for this is that since the traffic control
starts only after the classification is completed, those pre-classified
traffic is not controlled. This is usually not a problem but some P2P
protocols may require many packets to be inspected to classify and
if there is a heavy P2P user, the traffic for the user may exceed the PIR
slightly.
I think you can check which protocol is exceeding the PIR by looking
at the report which you realized the issue.
Thanks,
Tomo