When the VPNs are imported from the SRX firewall, SD is importing them with Hub and Spoke topology instead of using the Site-to-Site topology.

VPNs imported into SD show up with Hub and Spoke topology during the VPN import job instead of Site-to-Site topology

The VPN configuration on the SRX firewall is as below.

set security ike gateway Site-to-site-1 ike-policy Site-to-site-1
set security ike gateway Site-to-site-1 address 1.1.1.1
set security ike gateway Site-to-site-1 external-interface reth0.300
set security ike gateway Site-to-site-1 version v2-only
set security ike gateway Site-to-site-2 ike-policy Site-to-site-2
set security ike gateway Site-to-site-2 address 2.2.2.2
set security ike gateway Site-to-site-2 external-interface reth0.300
set security ike gateway Site-to-site-2 version v2-only
set security ike gateway Site-to-site-3 ike-policy Site-to-site-3
set security ike gateway Site-to-site-3 address 3.3.3.3
set security ike gateway Site-to-site-3 external-interface reth0.300
set security ike gateway Site-to-site-3 version v2-only
set security ike gateway Site-to-site-4 ike-policy Site-to-site-4
set security ike gateway Site-to-site-4 address 4.4.4.4
set security ike gateway Site-to-site-4 external-interface reth0.300
set security ike gateway Site-to-site-4 version v2-only
set security ipsec vpn Site-to-site-1 bind-interface st0.2
set security ipsec vpn Site-to-site-1 ike gateway Site-to-site-1
set security ipsec vpn Site-to-site-1 ike ipsec-policy Site-to-site-1
set security ipsec vpn Site-to-site-1 establish-tunnels immediately
set security ipsec vpn Site-to-site-2 bind-interface st0.4
set security ipsec vpn Site-to-site-2 ike gateway Site-to-site-2
set security ipsec vpn Site-to-site-2 ike ipsec-policy Site-to-site-2
set security ipsec vpn Site-to-site-2 establish-tunnels immediately
set security ipsec vpn Site-to-site-3 bind-interface st0.5
set security ipsec vpn Site-to-site-3 ike gateway Site-to-site-3
set security ipsec vpn Site-to-site-3 ike ipsec-policy Site-to-site-3
set security ipsec vpn Site-to-site-3 establish-tunnels immediately
set security ipsec vpn Site-to-site-4 bind-interface st0.6
set security ipsec vpn Site-to-site-4 ike gateway Site-to-site-4
set security ipsec vpn Site-to-site-4 ike ipsec-policy Site-to-site-4
set security ipsec vpn Site-to-site-4 establish-tunnels immediately

When you import the VPNs from the SRX firewall into SD, SD imports them with the Hub and Spoke topology with the SRX firewall as the Hub and the rest of the external IP-Addresses as spokes.

The reason why SD imports the VPNs with a hub and spoke topology is because SD has the option "Aggregate and Import unnumbered tunnels as Hub and Spoke" checkbox enabled by default.

If you disable the above option from Network Management Platform --> Administration --> Applications --> Right Click on Security Director --> Modify Application Settings --> VPNImport and then import the VPNs from the SRX firewall again, SD will import 4 VPNs with site-to-site topology with the SRX firewall as one end of the VPN and the external IP-Address as the remote end.