SSH ClientAliveInterval and stateful firewall connection drops

SSH session persistence relies on ClientAliveInterval and ClientAliveCountMax to detect dead peers at the protocol layer. These settings ensure the server terminates sessions when clients crash or lose connectivity without sending a TCP FIN packet.

However, intermediate stateful firewalls often maintain their own idle timeout timers. There is uncertainty regarding whether SSH protocol-level heartbeats are sufficient to reset these external timers, or if the firewall may still drop the connection despite active ClientAlive traffic.

• Does the SSH protocol-level heartbeat effectively prevent stateful firewall timeouts?
• What is the recommended coordination between ClientAliveInterval and typical network middlebox idle timers to ensure session stability?