This article explains an issue where the users from spoke side LAN cannot communicate with Hub side indirect subnet over the hub-to-spoke overlay tunnel.

You will see the tunnels are up and LAN direct subnets will be exported to BGP from each side using policy statements and export rules but the Hub will not export any indirect LAN subnets into BGP running over the hub-spoke tunnel. If you check the BGP routes advertised by the hub from the hub cli you will only see the direct subnet getting advertised. If the route is not advertised by the hub, we will definitely not see it in the spoke routing table.

This is an expected behaviour. MIST will only advertise the direct subnets into BGP running over hub-to-spoke tunnel. You need to add the indirect routes/subnets in the USERS section of a LAN network from the MIST UI and then add that subnet in the hub-to-spoke policy. You also need to leak these routes from the LAN routing instance to overlay VPN routing instance using the additional CLI commands because these routes will be added only in the LAN routing instance by default.