We ran into an interesting case where we can't terminate tunnel interfaces on virtual routers on a SRX - only the primary. Has anyone else run into this? It's pretty critical to how we deploy our networks to meet PCI.