This article explains about the behaviour of tcp-encap log option.
When you have two VPN profiles to connect to the same gateway <local-address> and tcp-encap log is enabled, it will fail to log for one of the profile.
set security ike gateway Remote-Access-VPN tcp-encap-profile JSC-SSL-Profile
set security ike gateway Remote-Access-VPN-1 tcp-encap-profile JSC-SSL-Profile-1
set security tcp-encap profile JSC-SSL-Profile ssl-profile JSC-Termination-Point
set security tcp-encap profile JSC-SSL-Profile ports 443
set security tcp-encap profile JSC-SSL-Profile-1 ssl-profile JSC-Termination-Point-1
set security tcp-encap profile JSC-SSL-Profile-1 ports 443
set security tcp-encap profile JSC-SSL-Profile-1 log >> log option is enabled on the second profile.
When I connect the primary VPN, which has no log option, still we could see the tcp-encap logs generated:
root> show log tcp-encap | match tcp
Jul 9 02:15:42 RT_RAGW: TCP_ENCAP_SESSION_CREATE: lsys:root-logical-system 8589956814 <192.168.100.10/63891->192.168.100.1/443> NAT:<192.168.100.1/63891->192.168.100.10/44
3> <JSC-Untrust/ge-0/0/2.0->junos-host/.local..0> NCP-Pathfinder version 2
Jul 9 02:15:45 RT_RAGW: TCP_ENCAP_SESSION_CLOSE: lsys:root-logical-system 8589956814 <192.168.100.10/63891->192.168.100.1/443> NAT:<192.168.100.1/63891->192.168.100.10/443
> <JSC-Untrust/ge-0/0/2.0->junos-host/.local..0> NCP-Pathfinder version 2
When I move the tcp-encap log option to primary profile and connect the VPN using primary profile, tcp-encap log is not generated.
set security tcp-encap profile JSC-SSL-Profile log >>>>>>>>>
root> show log new | match tcp
Jul 9 02:41:05 mgd[25493]: UI_CMDLINE_READ_LINE: User 'root', command 'show log new | match tcp '
The reason for this behavior is that whichever profile is active in PFE will log activity if the logging option is enabled, regardless of the VPN you connect to.
In this instance, the JSC-SSL-Profile-1 was the active profile in PFE.
If you want to log activity for both profiles, assign a different local address for each VPN profile.