SSH ClientAliveInterval and stateful firewall connection drops

Direct answer

SSH ClientAliveInterval heartbeats typically prevent stateful firewall idle‑timeout drops when the firewall resets its timer on any packet that traverses the connection. If the firewall’s idle timeout is longer than the heartbeat interval, the session stays alive.

Confirmed fact

• When the firewall counts any TCP traffic (including encrypted SSH heartbeats) as activity, a ClientAliveInterval shorter than the firewall’s idle timeout prevents the connection from being dropped.

Likely explanation (firewall may ignore encrypted traffic)

Some middleboxes only reset timers on new SYN packets or on traffic matching known application signatures. Because SSH traffic is encrypted, the firewall may not recognize the heartbeat as activity, allowing the idle timer to expire and the connection to drop despite active ClientAlive traffic.

Coordination steps (what to do)

1. Discover the firewall’s idle timeout. Ask the network team or capture traffic to measure how long an idle SSH flow survives before the firewall closes it.
2. Set ClientAliveInterval to less than half that timeout. For example, if the firewall times out after 300 s, use 120 s or less.
3. Keep ClientAliveCountMax low (2‑3) so the server terminates a truly dead client quickly while still allowing a few missed heartbeats.
4. Verify on the server: run tcpdump -i any -nn port 22 while the client is idle and confirm a packet appears every ClientAliveInterval seconds.
5. If the firewall ignores encrypted heartbeats, enable TCPKeepAlive yes in sshd_config to send OS‑level keepalive packets, which middleboxes see as standard TCP keepalive.

Ask for missing diagnostic detail

To fine‑tune the exact ClientAliveInterval value, I need to know the idle timeout configured on the stateful firewall. If you can provide that number, I can recommend a specific interval that guarantees stability.