WAF Audit logs were not triggered

Hello,

I am tried to have a test for a WAF of SG.

I made a test lab using vmware and I configured a vulnerable website using DVWA.
And then tried to send attack traffics from a Kali Linux (name of tool that I used is OWASP ZAP.) to DVWA.
Also i ran XSS on the DVWA, it was successes .
But any audit logs were not triggered on the SG appliance.

One of Sophos staffs told me that I need to use domain or public ip address to trigger WAF audit log.
It cannot understand this explanation that because all traffics including XSS and OWASP ZAP traffics were reached to destination throughout SG UTM.

This is my simple diagram for this test. 

 Here is my configure for WAF. 

    <Virtual Server>                      <Real Server>                       <Site Route>

And DNAT is configured to access the web server from outside of firewall

It would be much appreciated, if you help me for my issue. 

Thanks,