Intermittent SSH connection problems

[sfrazer]

Hi.

I've recently added a new pair of pfSense 2.1-RELEASE firewalls to one of our data centers and am having intermittent problems connecting to either the firewall or servers behind the firewall over SSH.

Roughly about 1 out of every 3 connection attempts will fail with a timeout message after about 60 seconds. Packet captures show the source sending SYN retransmissions that never get ACKed. The destination firewall does NOT show the retransmissions. If the connection is established it stays solid.

This behavior occurs regardless of source (I have 3 other data centers to test from and several home connections also have the same issue) and if I remove the firewall from the path (by placing a server directly on the WAN network) the problems disappear.

I'm not showing anything about dropped packets in the logs and the rules are setup to allow all IPv4 packets from the sources we're testing from.

Any suggestions for what to look at next?

Thanks