I don't have a reference at the moment, but we saw something matching
this with traffic coming across an IPSec tunnel to a "core" firewall,
then having flow mode UTM applied there before going out to the
Internet. Issue was relatively inconsistent. I...
