The spoke has no policy it just modem + router, the strange is when i try to ping from the client behind the Hub with the destination is client behind the spoke, i dont see any traffic goes out, if I check log from policy in the Hub.
meanwhile, the zone for the tunnel in the zone i choose for the policy for this traffic, and the routing for the client behind the spoke already set into the tunnel interface....any clue ??