Contoso has a hub-and-spoke topology. The hub VNet contains a third-party firewall NVA. Spoke1 is peered to the hub, and a user-defined route in Spoke1 sends all outbound traffic (0.0.0.0/0) to the NVA's private IP in the hub. Traffic from Spoke1 reaches the NVA, but return traffic and traffic that the NVA forwards back toward other destinations is being dropped at the hub peering. Which peering configuration change should you make on the hub-to-spoke peering to resolve this?