In the hub GUI, from the primary hub the "transfer check" works fine on non tunneled hubs but not on tunneled hubs.
Release : 20.3
Component : UIM - HUB
Try a transfer check from opposite direction (remote hub to primary) and check if that works.
As long as it works fine, there is no issue - this is related to firewall restrictions for the direction of traffic (which is not unusual in a tunneled environment.)
If it fails in both directions you should open a support case to investigate the tunnel health.