[pfSense Support] captive portal - Is this possible?

[Szasz Revai Endre]

Hello,

Today I noticed a user time out using the captive portal:
Oct 30 10:20:18     logportalauth[56054]: TIMEOUT: shimon, 00:07:95:d3:d2:97, 192.168.11.100
It is using an ip from the class of the lan.
The problem is, that I assign ip addresses to all the users of the LAN, with static arp entries.
This user is not in the list (not the ip, nor mac address). How is that possible that he logged on from that ip?
He shouldn't even be seeing the pfsense gateway if I have static arp entries, right?

Any wild guesses?
Thank you.