Description

This article explains about the behaviour of tcp-encap log option.

Symptoms

When you have two VPN profiles to connect to the same gateway <local-address> and tcp-encap log is enabled, it will fail to log for one of the profile.

set security ike gateway Remote-Access-VPN tcp-encap-profile JSC-SSL-Profile

set security ike gateway Remote-Access-VPN-1 tcp-encap-profile JSC-SSL-Profile-1

set security tcp-encap profile JSC-SSL-Profile ssl-profile JSC-Termination-Point

set security tcp-encap profile JSC-SSL-Profile ports 443

set security tcp-encap profile JSC-SSL-Profile-1 ssl-profile JSC-Termination-Point-1

set security tcp-encap profile JSC-SSL-Profile-1 ports 443

set security tcp-encap profile JSC-SSL-Profile-1 log >> log option is enabled on the second profile.

 

When I connect the primary VPN, which has no log option, still we could see the tcp-encap logs generated:

root> show log tcp-encap | match tcp

Jul 9 02:15:42  RT_RAGW: TCP_ENCAP_SESSION_CREATE: lsys:root-logical-system 8589956814 <192.168.100.10/63891->192.168.100.1/443> NAT:<192.168.100.1/63891->192.168.100.10/44

3> <JSC-Untrust/ge-0/0/2.0->junos-host/.local..0> NCP-Pathfinder version 2

Jul 9 02:15:45  RT_RAGW: TCP_ENCAP_SESSION_CLOSE: lsys:root-logical-system 8589956814 <192.168.100.10/63891->192.168.100.1/443> NAT:<192.168.100.1/63891->192.168.100.10/443

> <JSC-Untrust/ge-0/0/2.0->junos-host/.local..0> NCP-Pathfinder version 2

 

When I move the tcp-encap log option to primary profile and connect the VPN using primary profile, tcp-encap log is not generated.

set security ike gateway Remote-Access-VPN tcp-encap-profile JSC-SSL-Profile

set security ike gateway Remote-Access-VPN-1 tcp-encap-profile JSC-SSL-Profile-1

set security tcp-encap profile JSC-SSL-Profile ssl-profile JSC-Termination-Point

set security tcp-encap profile JSC-SSL-Profile ports 443

set security tcp-encap profile JSC-SSL-Profile log >>>>>>>>>

set security tcp-encap profile JSC-SSL-Profile-1 ssl-profile JSC-Termination-Point-1

set security tcp-encap profile JSC-SSL-Profile-1 ports 443

 

root> show log new | match tcp

Jul 9 02:41:05  mgd[25493]: UI_CMDLINE_READ_LINE: User 'root', command 'show log new | match tcp '

Solution

The reason for this behavior is that whichever profile is active in PFE will log activity if the logging option is enabled, regardless of the VPN you connect to.

In this instance, the JSC-SSL-Profile-1 was the active profile in PFE.

If you want to log activity for both profiles, assign a different local address for each VPN profile. 

Modification History

2024-07-09 : Article Created