SD does not support tunnel pair-policy syntax for policy-based VPN, this KB will help you with possible workarounds. 

SD is trying to delete below config during publish/update operation but the same is supported on Junos CLI; however it is not supported as per SD Design.

##Global address book configurations##

set security address-book global

##Security Firewall Policy : TRUST-MSCE-SIGNAL - UNTRUST-INTERNET##

delete security policies from-zone TRUST-MSCE-SIGNAL to-zone UNTRUST-INTERNET policy STP-TO-CITIC-1 then permit tunnel pair-policy

delete security policies from-zone TRUST-MSCE-SIGNAL to-zone UNTRUST-INTERNET policy STP-TO-CITIC-2 then permit tunnel pair-policy

##Security Firewall Policy : UNTRUST-INTERNET - TRUST-MSCE-SIGNAL##

delete security policies from-zone UNTRUST-INTERNET to-zone TRUST-MSCE-SIGNAL policy CITIC-TO-STP-1 then permit tunnel pair-policy

delete security policies from-zone UNTRUST-INTERNET to-zone TRUST-MSCE-SIGNAL policy CITIC-TO-STP-2 then permit tunnel pair-policy

Please note: Tunnel "Pair-policy" is not supported feature in SD as of now, due to which SD is trying to delete the same.

Workaround 1: You can remove the "pair-policy" configuration from device and import the policy again and try publishing the same. To provide support for "pair-policy" in SD, customer need to raise an enhancement request. *(Please check with your Juniper's Accounts team for details regarding Enhancement Request)

Workaround 2: Here is another workaround that is tested in JTAC lab to prevent Security Director from deleting the “pair-policy” commands:

Step 1:  Go to the Space Network Management Platform : select “Device Templates”> Templates> create a quick template.
 

Note: You must create the template for each set of command getting deleted.
 

In the Editor section : place the full configuration line and click “OK”. The system take you back to the quick template screen, here just click “ save “
 

Note: You need to use older schema version to create this template as all schema version are not supporting this set CLI syntax. Tested in lab with 12.1R3.5 schema version, highlighted in the above screenshot. In case if your schema doesn't support this set CLI, then need to file a bug along with DMI Schema team internally. You need to repeat the process to create another quick template for the other pair-policy command.

Example: Tested for below set CLI :

set security policies from-zone TRUST-MSCE-SIGNAL to-zone UNTRUST-INTERNET policy STP-TO-CITIC-1 then permit tunnel pair-policy CITIC-TO-STP-1

set security policies from-zone UNTRUST-INTERNET to-zone TRUST-MSCE-SIGNAL policy CITIC-TO-STP-1 then permit tunnel pair-policy STP-TO-CITIC-1

set security policies from-zone TRUST-MSCE-SIGNAL to-zone UNTRUST-INTERNET policy STP-TO-CITIC-2 then permit tunnel pair-policy CITIC-TO-STP-2

set security policies from-zone UNTRUST-INTERNET to-zone TRUST-MSCE-SIGNAL policy CITIC-TO-STP-2 then permit tunnel pair-policy STP-TO-CITIC-2

Step 2: Now, we need to move into Security Director > Configure> Firewall Policy > Profiles .. Here you will create a profile. Again, you will need to create one profile per template.
 

Select the proper template that you created on the platform and then click “OK”. Repeat the process to create a second Profile for the other template.
 

Note: Make sure to enable session initiate and session close logging as per your requirement.

Once you have finished creating the profiles. You can go to the specific firewall rule. There is a column for “Rule Options”, here you have the option to select “profile” you created. Make sure to select the one the hold proper “pair-policy” command that match with the specific rule.

This workaround should clean the delta for the delete commands.
 

After making the above changes, SD should not delete tunnel pair policy related config.

Note : If you face any issues, please contact JUNIPER JTAC Support for assistance.