Is it normal that traffic from the spoke network , can reach the networks behind the hub but not the other way around ?

In fact, If a ping attempted from the networks behind the Spoke to those behind the Hub this works fine, but if ping is attempted from the networks behind the Hub to those of the Spoke get no response.

Not able to ping from hub network to spoke network

The traffic flow between the hub and spoke is completely driven by configuration, as soon as device is onboarded , a hub profile and a wan edge template will be mapped to device to have the intended configuration.

So based on the configuration on this template the traffic will be driven. Most of the traffic rules are required to be added via the template or at the device level.

On a high level steps as follows

1. Setup Networks—Define the Networks. Networks are the source of traffic defined through IP prefixes. See Configure Networks.
2. Configure Applications—Applications are destinations that you define using IP prefixes. Applications represent traffic destinations. See Configure Applications.
3. Create hub profiles—You assign hub profile to standalone or clustered devices to automate overlay path creation. See Configure Hub Profiles.
4. Create WAN edge templates—WAN edge templates automatically configure repetitive information such as an IP address, gateway, or VLAN when applied to sites. See Configure WAN Edge Templates.
5. Create Application Policies— Application policies determine which networks or users can access which applications, and according to which traffic steering policy. See Configure Application Policies.

Traffic steering should be in place for direction of traffic you want communicate, In this case from hub -> spoke and spoke -> hub as well.

A sample configuration is available in Traffic steering between Hub and spoke