USG FLEX 50HP (uOS 1.39, Nebula-managed): firewall-originated traffic (AD/RADIUS lookup) does not en

Two Nebula-managed sites: USG FLEX 200H at the main site with the Windows AD, USG FLEX 50HP at a branch, Nebula site-to-site VPN between them, both uOS 1.39, NCC 20.10.

The 50HP should authenticate SSL-VPN users against the AD at the main site. Traffic from LAN clients crosses the tunnel fine (domain-joined PCs, DNS). Traffic generated by the 50HP itself does not: cmd diagnostics ping to the DC gives 100 % loss, also with interface VLANx (the branch LAN interface inside the tunnel's networks) as source; the same happens from the 200H toward the branch firewall. The AD server test on the 50HP reports "Wrong IP or Port". Only the DNS zone forwarder on the 50HP reaches the DC.

Is there a supported way on uOS/NCC to route firewall-originated traffic (AD or RADIUS lookups) into the Nebula site-to-site tunnel? The knowledge base article for ZLD (policy route from any source to the AD IP into the tunnel, plus a return route at the main site) has no equivalent that I can find in NCC for the H series.

Diagnostic files and serial numbers available by private message.