same session from diffrent computers over VPN

[eluser]Dariusz-Gdynia[/eluser]
The problem is with session.

I have people in one place from one company who are connecting with internet over VPN (their admin says, that they are behind NAT and every user outside has same ip and same outgoing port).

When one person (person A) logins (creates session) everything is ok... the problem is when another person from same network comes to my website and... he/she doesn't need to login beacuse he/she is already logged as person A!

This occured second time in my 3years experience, so it's not "just a problem generally". It happed twice and both companys are using VPN.

I tried standard session library and "native session" - no difference.

My server:
Apache/2.2.6
MySQL: 5.1.16
PHP Version 5.2.2

My setting of session:
$config['sess_cookie_name'] = 'ci_session';
$config['sess_expiration'] = 7200;
$config['sess_encrypt_cookie'] = TRUE;
$config['sess_use_database'] = TRUE;
$config['sess_table_name'] = 'ci_sessions';
$config['sess_match_ip'] = FALSE;
$config['sess_match_useragent'] = TRUE;
$config['sess_time_to_update'] = 300;


Thanks for any advice...
ps. I have problems with testing. That company is quite not interested in helping me, it's interested in working website.

[eluser]WanWizard[/eluser]
That is weird, and I can't say I can reproduce that problem (I have one site running with 13.000+ users behind a proxy).

The correct session is loaded based on the value of the session cookie. When you load the session class, it tries to retrieve this cookie so the session can be loaded. If this cookie is not found, a new session is created.

Since this cookie is stored on the users PC in the browsers cookie cache, proxies and NAT are not relevant to the way the session library works. I can even use Firefox, Chrome and IE on the same computer, and have three different sessions to the application.

As to logging, you could try writing the contents of the session cookie to the log. In the session library, find sess_read(), look for the line "$session = $this->_unserialize($session);", and write $session to the log. If you also log the user logged in, you might be able to see what happens.