A VPN between SRX device and Palo Alto is flapping. The reason is a Traffic Selector mismatch as per the below log.
KMD_VPN_TS_MISMATCH: Traffic-selector mismatch, vpn name: VPN-NAME, Peer Proposed traffic-selector local-ip: ipv4(0.0.0.0-255.255.255.255),ipv6(::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff), Peer Proposed traffic-selector remote-ip: ipv4(0.0.0.0-255.255.255.255),ipv6(::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff)
This issue is most likely between SRX and Palo Alto (PA).
According to the information gathered, PA is on default configuration and sends Traffic Selector for IPv4 & IPv6 as well. That is something the PA Team had explained. When the SRX receives a TS with 2 values (1 for ipv4 & another for ipv6) they are treated as 2 TSs due to different IP protocols.
So, the SRX seems to be recognizing this situation on either modes, initiator and responder however, it is more sensitive when working as a responder.
When the SRX works as initiator, PA is recognizing the mismatch and sends the "delete payload" message since there is something that does not match, this time, the TS.
I also got documentation explaining the SRX platform was improved to accept both, IPv4 and IPv6 in a single TS. This is with the purpose to be in compliance with the RFC 7296.
https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traffic-selector-edit-security.html
"The terms in a single traffic selector can have both IPv4 and IPv6 address. Hence a single IPsec SA has both IPv4 and IPv6 as both local and remote IP addresses."
There is also another document about it.
https://apps.juniper.net/feature-explorer/feature-info.html?fKey=10807&fn=Enhancements%20to%20increase%20traffic%20selector%20flexibility
The Traffic selector enhancements ("term") is available only the with new 'junos-ike' architecture.
Junos-ike architecture is currently supported only in SRX5K-SPC3 (SRX5400, 5600 and 5800), NFX350, vsrx3.0 devices.
Currently, there are no plans to support the same in srx-branch-series of devices which includes srx-3xx devices and the documentation is in process to be updated.
So, for now, the fix from the SRX side is make it the initiator. Palo Alto has a feature to make it as "passive" thus, it will be the VPN responder.