This article provide information on the Juniper secure connect flow and REMOTE_ACCESS_VPN_LOGOUT_OK log.

Customer might have a query "Q)why does the log shows logged out successfully when the VPN is up and traffic is flowing"

FWhttpd-gk: REMOTE_ACCESS_VPN_AUTH_OK: User amr/RA-VPN from <IP> with user-application <IP> authenticated successfully
FW httpd-gk: REMOTE_ACCESS_VPN_CONFIG_DOWNLOAD_OK: User amr/RA-VPN from <IP> with user-application <IP> downloaded configuration successfully 
FW httpd-gk: REMOTE_ACCESS_VPN_LOGOUT_OK: User amr/RA-VPN from 1 <IP> with user-application <IP> logged out successfully 

Lets understand the flow of the JSC

URL entered on the JSC client ----> DNS resolution takes place ---> Then TCP handshake ---> Then TLS handshake with server authentication -----> Then HTTP  ---> Then Client Authentication ----> When the client authenticated then the user login successfully ----> download client configuration -----> logout http session ---> Client initiate IPSEC VPN using downloaded client config.

When a Juniper Secure Connect client connects, the SRX’s HTTP gateway daemon (httpd-gk) first authenticates the user, then serves the client configuration over HTTPS, and finally terminates that HTTP session—logging REMOTE_ACCESS_VPN_LOGOUT_OK. Only after that does the kernel key management daemon (kmd) perform the IKE negotiation and bring up the IPsec SAs. In other words, the LOGOUT_OK refers solely to the end of the HTTP‐based config‐download session, not to tearing down the VPN tunnel itself.

Please refer the below sample successful JSC connection logs,

SRX-fw httpd-gk: REMOTE_ACCESS_VPN_AUTH_OK: User amr/RA-VPN from <IP> with user-application <IP> authenticated successfully 
 FW httpd-gk: REMOTE_ACCESS_VPN_CONFIG_DOWNLOAD_OK: User amr/RA-VPN from <IP> with user-application <IP> downloaded configuration successfully
SRX-fw httpd-gk: REMOTE_ACCESS_VPN_LOGOUT_OK: User amr/RA-VPN from 1 <IP> with user-application <IP> logged out successfully 
SRX-fw kmd[2020]: IKE negotiation successfully completed. IKE Version: 1, VPN: JSC-IPSEC-VPN Gateway: JSC-IKE-GATEWAY, Local: X.X.X.X/4500, Remote: Z.Z.Z.Z/20049, Local IKE-ID: X.X.X.X, Remote IKE-ID: remote.mydomain.local, VR-ID: 0, Role: Responder
SRX-fw kmd[2020]: KMD_PM_SA_ESTABLISHED: Local gateway: X.X.X.X, Remote gateway: Z.Z.Z.Z, Local ID: ipv4(10.131.33.0-10.131.33.255), Remote ID: ipv4(10.131.35.13), Direction: inbound, SPI: 0x4016b0f9, AUX-SPI: 0, Mode: Tunnel, Type: dynamic, Traffic-selector: JSC-TS-1 FC Name:
SRX-fw kmd[2020]: KMD_PM_SA_ESTABLISHED: Local gateway: X.X.X.X, Remote gateway: Z.Z.Z.Z, Local ID: ipv4(10.131.33.0-10.131.33.255), Remote ID: ipv4(10.131.35.13), Direction: outbound, SPI: 0x8d8a552b, AUX-SPI: 0, Mode: Tunnel, Type: dynamic, Traffic-selector: JSC-TS-1 FC Name:

REMOTE_ACCESS_VPN_AUTH_OK :- Logged by the J‑Web gateway kit HTTP daemon (httpd‑gk) when the user’s XAuth credentials are accepted
REMOTE_ACCESS_VPN_CONFIG_DOWNLOAD_OK :-Indicates the client successfully downloaded its IPsec configuration over HTTPS from the SRX Juniper Networks. 
REMOTE_ACCESS_VPN_LOGOUT_OK :- Marks the graceful termination of that HTTP session by httpd‑gk once config download completes; it does not imply the IPsec tunnel has been torn down