For the Session Smart Router deployments, for the traffic to traverse between a hub and spoke, you must use the same name for networks on both sides. The network name for Session Smart Router is identical to a security tenant used for traffic isolation. So, the name must match on both the sides.

If you configure different network objects in the application policy then the traffic may not be working as expected.

• In Hub and Spoke scenario when traffic is traversed between hub and spoke it only looks for the tenent name to allow the traffic.
• SSR will be able to identify the source tenent name from the packet which is coming from spoke.
• Based on the source tenent name it will allow/deny the traffic.
• Here is the example of application policy configured between Hub and Spokes.

Hub

Spoke1

Spoke2