Hello Nikolay -Did you ever get this working? My understanding that this is not a supported configuration where the tunnel source/destination addresses are in a VRF and the tunnel itself is in the global table. I have this working opposite where the ...

This usually happens because the traffic is being natted over the tunnel. Did you create the NoNat list for each side?Sent from Cisco Technical Support iPad App

This sounds like a nonat issue. Can you please post the NAT configuration? You did create the statements to not NAT the traffic going over the tunnel, correct?Sent from Cisco Technical Support iPad App

That actually needs to be registered with the SVI IP Address not the HSRP address.Configure squid to register to both the core switches.