You have Hub VNet connected to the on-premises network and Spoke VNet peered with Hub VNet. In Hub VNet there is a virtual network gateway and firewall. How will you ensure that traffic between Spoke VNet and Hub VNet flows through the firewall?