I was told the firewall accepts the connections for pxp-agent and has an idle timeout of 60minutes. and in general connections work. it just looks like some are aborted from time to time