Hi,

 that should be possible, yes, through the dedicated default "Simultaneous Connections Detection" Firewall rule to be configured accordingly.

You can customize the corresponding "Catch Multiple connections" condition, specifically to :

• uncheck "Returning Only", so that a new connection is not possible rather that the original computer being logged off (the default policy is "no coming back to the original computer").
• switch the "Discrimination Source" from "XForwarded IP" to "Session" to support your case of an internal network with shared public IP.

You can also customize the resulting sequence of actions, such as the email template sent to the account holder, or maybe in order to add a redirection to a page with a dedicated message (see "Critical Accounts Protection" for an example of such an action that you can copy), or to directly display a page message to the user (see "Warn IE 6 Users" for an example of such an action that you can copy)

Regards

This seems unintended behavior indeed. With the above configuration, you should have:

When a single account logs in from 2 computers or from 2 browsers similarly (or one in regular mode and one in private mode, session being stored in cookie), without "returning only" checked, the 2nd user should get logged off (otherwise, the 1st one will trigger detection). An email should be sent each time a detection is triggered, that is each time a new connection is attempted in your case, or each time a returning user logs in with "returning only" checked.

I guess I should do some tests to see if for some reason the rule stopped working correctly. 

I'll get back to you when I know more about it, and if it's a bug I'll send you a patch.