@evt
That is the best answer, but in practice there is one thing I noticed broke in doing the work around. If you are going to use a Virtal type instance to use as your management you may run into some issues if you are monitoring it from a device that doesn't belong to that specific instance. This was an issue I ran into in production and this code was introduced in Junos 11.4R and was still a problem after upgrading to recommended release currently 12.1X44
By default all zones "should" access this which is for all montioring traffic that shows up in the SRX security flow table as "self-generated-traffic", but it doesn't work as expected in some circumstances.
I found and had long conversations with Juniper about this, because I was trying out their licenses. But their to resolve the host-name for the license the DNS and FTP functionality wouldn't work since it was going from a specific Virtual instance that was hosting different ISP's & DMZ zones out to the Internet. (I had to build out tunnels and redirect the traffic just to make it work, needless to say I decided not to bother with any of the SRX Security Licences because of this and it's massive consumption of resources)
This isn't harmful if you are doing simple things in the management network, but you have to adjust your snmp string to monitor it properly. Link below, but forum doesn't describe the type of scenerio you want. Put example below.
http://kb.juniper.net/InfoCenter/index?page=content&id=KB13080&actp=search&viewlocale=en_US&searchid=1248337489201
EXAMPLE: If your using snmp v2 community string is public you would need to configure your snmp server string to be @public (this is covered in another forum, but they advise to use the "virtual-instance-name"@public. That will only run snmp query within the virtual instance. Leaving the instance name out allows it to poll any virtual instance if multiple exist on the device properly.
Also, configure your device to allow it under snmp allowing * for any zone access or specify the virtual instance:
ataveras@SRX240H2> show configuration snmp routing-instance-access
access-list {
*;
}