When you select the Network for Sites 2 or 3, does the subnet for the other site appear in the Route Table for that MX?
Select Network for Site 2. Go to Security & SD WAN > Route Table. Does the subnet for Site 3 appear in the list?
Under Site-to-Site VPN settings, do you see Site 3 and its subnet listed in the "Remote VPN participants" list?
Are there any rules defined under the "Site-to-site outbound firewall" section?
If you do a traceroute from a host in Site 2 to a host in Site 3, what happens?