This article explains an issue where the primary IPSEC tunnel is down while the backup tunnel is up and running

All the primary VPN tunnels are seen DOWN on checking from the SRX CLI using the command "show security ike security-association" while as the backup tunnels remain fully functional.

This issue can been seen if the primary ISP link (underlay link) is down while as the secondary ISP link is up and running. This is an expected behaviour, as the underlay link has to be up and running for the overlay tunnels to function properly.