Assuming the spokes are connected to a common virtual MX in the same Umbrella DC you can consider it that Umbrella itself is not decrypting the traffic. The vMX will effectively doing this, I suspect, when flipping between the two tunnels
... View more
