class-map protocol misidentification

ChooseLife

It seems my router is not identifying some of the protocols properly. The two I found not to work are ssh and https. "match protocol ssh" and "match protocol https" in class-map blocks the traffic, replacing either one with "match protocol tcp" immediately allows the respective traffic through, so other components, like routing should not be affecting.

Both of these services are running on another Cisco router. ssh is ssh-v2, https is the regular "ip http secure-server".

ChooseLife

The relevant part of the config:

class-map type inspect match-any class-map-ICMP
 match protocol icmp
class-map type inspect match-any class-map-HTTPS
 match protocol https
 match protocol http
class-map type inspect match-any class-map-SSH
 match protocol ssh

policy-map type inspect policy-Allow
 class type inspect class-map-ICMP
  pass
 class type inspect class-map-HTTPS
  pass
 class type inspect class-map-SSH
  pass
 class class-default
  drop

zone security zone-Inside
zone security zone-Outside

zone-pair security Inside-to-Outside source zone-Inside destination zone-Outside
 service-policy type inspect policy-Allow
zone-pair security Outside-to-Inside source zone-Outside destination zone-Inside
 service-policy type inspect policy-Allow

interface FastEthernet4
 ip address 172.16.8.71 255.255.0.0
 zone-member security zone-Outside
 duplex auto
 speed auto
interface Vlan1
 ip address 192.168.2.87 255.255.255.0
 zone-member security zone-Inside