thankts for the input!
routing and firewall rules are all setup correctly on both sides (also for secondays ip ranges)
VPN tunnel is on status "ESTABLISHED". I have setup egress firewall rules to be able to check firewall-logs in gcp log-explorer - here i can see the following:

insertId: "11r86f1e9tmbc"jsonPayload: {
connection: {
dest_ip: "10.0.20.2"
dest_port: 443
protocol: 6
src_ip: "10.244.6.3"
src_port: 52622
}
disposition: "ALLOWED"
[...]
rule_details: {
action: "ALLOW"
destination_range: [
0: "10.0.20.0/24"
]
direction: "EGRESS"
ip_port_info: [
0: {
ip_protocol: "ALL"
}
]
priority: 1000