Presently, the quad-zero user-defined route in the route table for the ACA subnet routes all egress from that subnet to the firewall in the hub. This is appropriate for egress from the entire spoke; however, traffic within the spoke would be sent right back from the hub.

Instead, we should provide an option to keep spoke traffic internal. This is normal workload traffic that often does not require additional inspection. To avoid changing existing behavior, the option should be turned off by default.