For reference, problem was fixed in 4.4.2.
It was this bug:
https://www.netiq.com/documentation/...l#t46m6iq367pr

So disabling session assurance also helped.

//s