Can you share the configuration on your SSG?
What happens if you try to ping between the real IP addresses: 192.168.4.254 and 192.168.1.254? Does it work (assuming you have the routes configured as well)? Im just trying to isolate any other issues in between.
I can see that you have IP address 192.168.2.1 configured on the SSG's eth0/3 interface. Unless you are using it for a different purpose, it is not necessary for these communications. Can you delete it?