Unable to route traffic with FusionHub in Azure

I am working on using FusionHub as a possible solution in my Azure test environment to connect with our onprem offices’ Balance devices.

I am able to establish the PepVPN from onprem to the Azure FusionHub. The FusionHub advertises the correct route when looking at the status of the FusionHub profile.

I can ping from the FusionHub device to a test VM in the test Azure vnet I created. However I cannot ping or RDP from the test VM to a physical server on the onprem network (which is behind a Balance 380) and vice versa (can’t ping or RDP from the physical to the Azure test VM).

I have looked at the Network Security group applied to the Vnet and the FusionhubVM and it should allow traffic from onprem. I was thinking maybe the Azure routetable on the vnet to make the FusionHub the next hop was the problem, but that just cut off my access to the FusionHub and the Azure test VM.

Anybody know what the issue could be?