Thanks for the response. Here is a copy of the datapath session table, along with the output showing that the user has a L3 role of guest. This users HTTP traffic was being sent directly to the firewall, bypassing the proxy. I've attached a snippet of a packet capture that, in this case, shows a packet from the firewall directly to the user, and the source MAC address is the MAC address of the firewall. And there are packets in the other direction that show the destination address to be the MAC of the firewall.
Datapath Session Table Entries
------------------------------
Flags: F - fast age, S - src NAT, N - dest NAT
D - deny, R - redirect, Y - no syn
H - high prio, P - set prio, T - set ToS
C - client, M - mirror, V - VOIP
Q - Real-Time Quality analysis
I - Deep inspect, U - Locally destined
E - Media Deep Inspect, G - media signal
u - User Index
Source IP Destination IP Prot SPort DPort Cntr Prio ToS Age Destination TAge UsrIdx UsrVer Flags
-------------- -------------- ---- ----- ----- ---- ---- --- --- ----------- ---- ------ ------ -----
172.XX.XX.230 8.8.8.8 17 63307 53 1/2 0 224 1 tunnel 181 10 50 ad3c FCI
172.XX.XX.230 8.8.8.8 17 52087 53 1/2 0 224 1 tunnel 181 d 50 ad3c FCI
172.XX.XX.230 184.73.152.242 6 50864 80 1/2 0 96 1 tunnel 181 6c 50 ad3c FC
172.XX.XX.230 17.149.32.33 6 50489 5223 1/2 0 96 54 tunnel 181 904 50 ad3c C
172.XX.XX.230 209.234.225.225 6 50911 80 1/2 0 96 1 tunnel 181 f 50 ad3c C
172.XX.XX.230 12.167.75.52 6 50715 443 1/2 0 96 31 tunnel 300 47b 50 ad3c C
23.21.207.212 172.XX.XX.230 6 80 50904 1/4 0 160 1 tunnel 181 27 0 0 F
184.73.152.242 172.XX.XX.230 6 80 50864 1/4 0 96 1 tunnel 181 6c 0 0 F
96.17.203.19 172.XX.XX.230 6 80 50910 1/4 0 160 0 tunnel 181 10 0 0
96.17.203.19 172.XX.XX.230 6 80 50905 1/4 0 160 0 tunnel 181 27 0 0 F
96.17.203.19 172.XX.XX.230 6 80 50903 1/4 0 160 0 tunnel 181 2c 0 0 F
96.17.203.19 172.XX.XX.230 6 80 50901 1/4 0 160 0 tunnel 181 2c 0 0 F
96.17.203.19 172.XX.XX.230 6 80 50898 1/4 0 160 1 tunnel 181 40 0 0 F
96.17.203.19 172.XX.XX.230 6 80 50913 1/4 0 160 0 tunnel 181 d 0 0
54.197.232.215 172.XX.XX.230 6 80 50724 1/4 0 160 0 tunnel 300 453 0 0
172.XX.XX.230 54.225.161.49 6 50909 80 1/2 0 160 0 tunnel 181 10 50 ad3c C
172.XX.XX.230 54.225.161.49 6 50897 80 1/2 0 160 0 tunnel 181 41 50 ad3c FC
172.XX.XX.230 54.225.161.49 6 50902 80 1/2 0 160 1 tunnel 181 2c 50 ad3c C
172.XX.XX.230 54.225.161.49 6 50900 80 1/2 0 160 0 tunnel 181 2c 50 ad3c FC
172.XX.XX.230 96.17.203.19 6 50913 80 1/2 0 160 0 tunnel 181 d 50 ad3c C
172.XX.XX.230 96.17.203.19 6 50898 80 1/2 0 160 1 tunnel 181 40 50 ad3c FC
172.XX.XX.230 96.17.203.19 6 50903 80 1/2 0 160 0 tunnel 181 2c 50 ad3c FC
172.XX.XX.230 96.17.203.19 6 50901 80 1/2 0 160 0 tunnel 181 2c 50 ad3c FC
172.XX.XX.230 96.17.203.19 6 50906 80 1/2 0 160 1 tunnel 181 21 50 ad3c C
172.XX.XX.230 96.17.203.19 6 50905 80 1/2 0 160 0 tunnel 181 27 50 ad3c FC
172.XX.XX.230 96.17.203.19 6 50910 80 1/2 0 160 0 tunnel 181 10 50 ad3c C
172.XX.XX.230 96.17.203.19 6 50908 80 1/2 0 160 1 tunnel 181 19 50 ad3c FC
54.235.139.23 172.XX.XX.230 6 80 50912 1/4 0 160 0 tunnel 181 d 0 0
209.234.225.225 172.XX.XX.230 6 80 50911 1/4 0 96 1 tunnel 181 f 0 0
54.225.161.49 172.XX.XX.230 6 80 50900 1/4 0 160 0 tunnel 181 2c 0 0 F
54.225.161.49 172.XX.XX.230 6 80 50902 1/4 0 160 1 tunnel 181 2c 0 0
54.225.161.49 172.XX.XX.230 6 80 50897 1/4 0 160 1 tunnel 181 41 0 0 F
54.225.161.49 172.XX.XX.230 6 80 50909 1/4 0 160 0 tunnel 181 10 0 0
172.XX.XX.230 54.235.139.23 6 50912 80 1/2 0 160 0 tunnel 181 d 50 ad3c C
172.XX.XX.230 207.223.6.23 6 50907 80 1/2 0 96 1 tunnel 181 20 50 ad3c FC
12.167.75.52 172.XX.XX.230 6 443 50715 1/4 0 96 30 tunnel 300 47b 0 0
172.XX.XX.230 23.21.207.212 6 50904 80 1/2 0 160 0 tunnel 181 27 50 ad3c FC
172.XX.XX.230 54.197.232.215 6 50724 80 1/2 0 160 0 tunnel 300 453 50 ad3c C
207.223.6.23 172.XX.XX.230 6 80 50907 1/4 0 96 1 tunnel 181 20 0 0 F
8.8.8.8 172.XX.XX.230 17 53 52087 1/4 0 224 1 tunnel 181 d 0 0 FI
8.8.8.8 172.XX.XX.230 17 53 63307 1/4 0 224 1 tunnel 181 10 0 0 FI
17.149.32.33 172.XX.XX.230 6 5223 50489 1/4 0 96 54 tunnel 181 904 0 0
Name: xxxxxxxxxxx, IP: 172.XX.XX.230, MAC: ac:cf:5c:53:39:61, Role:guest, ACL:3/0, Age: 01:19:15
Authentication: Yes, status: started, method: Web, protocol: PAP, server: Internal
Bandwidth contract = 2MegUp (2000000 bits/sec)
Bandwidth contract = 15MegDown (15000000 bits/sec)
Role Derivation: Matched server rule
VLAN Derivation: unknown
Idle timeouts: 0, ICMP requests sent: 0, replies received: 0, Valid ARP: 0
Mobility state: Wireless, HA: Yes, Proxy ARP: No, Roaming: No Tunnel ID: 0 L3 Mob: 0
Flags: internal=0, trusted_ap=0, l3auth=1, mba=0
Flags: innerip=0, outerip=0, guest=0, download=1, nodatapath=0, wispr=0
Auth fails: 0, phy_type: g-HT, reauth: 0, BW Contract: up:2 down:4, user-how: 14
Vlan default: 883, Assigned: 0, Current: 883 vlan-how: 0 DP assigned vlan:0
Mobility Messages: L2=0, Move=0, Inter=0, Intra=0, ProxyArp=0, Flags=0x0
Tunnel=0, SlotPort=0x1040, Port=0x1135 (tunnel 181)
Role assigment - L3 assigned role: n/a, VPN role: n/a, Dot1x cached role : n/a
Current Role name: guest, role-how: 2, L2-role: xxxxxxxxxxx-guest-logon, L3-role: guest
Essid: xxxxxxxxxxx, Bssid: 00:0b:86:73:03:a1 AP name/group: xxxxxxx/yyyyyyy Phy-type: g-HT
RadAcct sessionID:n/a
RadAcct Traffic In 491451/36874150 Out 787695/1125975286 (7:32699/0:0:562:42918,12:1263/0:0:17181:1270)
Timers: ping_reply 0, spoof reply 0, reauth 0
Profiles AAA:xxxxxxxxxxx-aaa_prof, dot1x:, mac: CP: def-role:'xxxxxxxxxxx-guest-logon' sip-role:'' via-auth-profile:''
ncfg flags udr 1, mac 0, dot1x 0, RADIUS interim accounting 0
IP Born: 1403112801 (Wed Jun 18 12:33:21 2014)
Core User Born: 1403112797 (Wed Jun 18 12:33:17 2014)
Upstream AP ID: 0, Downstream AP ID: 0
DHCP assigned IP address 172.XX.XX.230, from DHCP server 172.XX.XX.5
Device Type: Mozilla/5.0 (iPad; CPU OS 7_0_4 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Mobile/11B554a