For an environment with a Primary hub and several secondary hubs - where the secondary hubs are not tunnel hub - customer needs to convert some of the secondary hubs to Tunnel HUBs.
Release : 20.3
Component : UIM - HUB
If you need to set up a tunnel between the primary HUB and the secondary HUB, where the secondary HUB is on the other side of a Firewall (DMZ) - you need to uninstall this secondary hub, and reinstall it. And, when you get the prompt during the installation - you need to set it up as a tunnel hub to begin with. If the firewall is in the way of communication, you won't be able to set up the tunnel using Admin Console, you would have to set it up at hub install time.