found the problem - indeed it was the firewall. It was blocked off. But since the connections are stateful and had been established, they hung on until I restarted the agents. As each agent was restarted, the firewall block for the return acknowledgment was blocked and thus the problem of the missing agents.
Oh well...
