FWIW, it looks like DHCP is failing to renew addresses on the private
network, causing Windows to release the address, and causing itt to
forget the firewall rule on port 22 and thus make it inaccessible to
VCL. One workaround would be to set the DHCP lease to a longer
period (say 24h) and stretch the time period before an image becomes
unreachable. I keep thinking there must be a way to get the
firewall rule to stick to the adapter even if the IP address is
released, but so far we haven't found the magic incantation to make
that happen.
