This is a variation of KB10107 [juniper.net]: [SRX] Route-based VPN is up, but not passing traffic. Is a route missing?

A VPN peer may not be using the VPN to get to is remote side because there is no existing route for that.

If the destination IP is the VPN itself, the customer can put an IP address on the st0 interface. This will trigger an automatic direct route insertion for the st0 subnet and IP address configured.

Note that when the destination IP or subnet is on the other side of the peer, a static route with next hop to the st0 interface needs to be configured, as explained on KB10107 [juniper.net].