GRE Tunnel issue I can‘t get my head around

Hi,

I‘m currently working on a GRE tunnel solution for ZScaler with 4 tunnels from two routers behind a FW that does NAT. I build a lab to test everything but my GRE tunnels don’t behave as expected. They show on two routers (the ZScaler side) up/up but are up/down on the enterprise side. I have keepalives in place and the IPs of the enterprise routers are static NATed to “public IPs”. Here is the Topology with NAT rules and translations, which seem good to me. And here is the config of Tunnel61, between Router 6 and Router 1.

interface Tunnel61

description "Zscaler Primary Tunnel"

vrf forwarding VRF1

ip address 172.16.61.6 255.255.255.0

ip tcp adjust-mss 1436

keepalive 10 3

tunnel source Loopback1

tunnel destination 10.12.1.1

tunnel vrf VRF1

Does anybody know why this is happening?