Hi Chris,
YOu need to check the below information to see how traffic is getting allowed:
1: get interface <tunnel.x>
2: debug flow basic (make sure you have specific filters for Ips e.g. set ffilter src-ip x.x.x.x dst-ip y.y.y.y)
KB: https://kb.juniper.net/InfoCenter/index?page=content&id=KB12208&actp=search
Thanks,
Vikas