clearing NAT for voip sip after dual wan failover

Question

On prior Cisco equipment with dual wan when redirecting or failing over our voip traffic from one isp to another it's been necessary to clear the associated network address translations (NAT) using the command below either manually or through eem triggers. Sip registrations and voice traffic would typically fail for a period of time until the nat expires or the command runs. Is there an equivalent to this on XG210_WP03_SFOS 17.5.0 GA# as an example? 
 
 #clear ip nat translation ? * Delete all dynamic translations esp Encapsulating Security Payload forced Delete all dynamic translations (forcefully) inside Inside addresses (and ports) outside Outside addresses (and ports) piggyback-internal Delete all dynamic translations created off of piggyback-data tcp Transmission Control Protocol udp User Datagram Protocol vrf Clear entries of VRF instance

KingChris · Accepted Answer

Hi momentum, 
 
 This can be accomplished in the web UI, under "WAN Link Manager". 
 You will need to have setup 2 gateways (obviously), with 1 set as "backup". Once the option of "backup" is selected, more menu items will appear. See screenshot below: 
 
 The important thing here is that you set in your firewall rules "WAN link load balance" as your primary gateway. 
 
 Thanks!

KingChris · Answer

For just clearing the NAT translations, there is no option currently. 
 You can use the "advance console" and run a conntrack deletion command if you know the NAT'ted IP connections you want to delete. Also there is no way to schedule this or set it as an action and will have to be manually run at the time. 
 Command that can be run is: conntrack -D -n <NAT IP address> This will delete all connections that are being NAT'ted to a specific IP address. 
 The best way to make sure all WAN bound connections terminate is using the "WAN Link Manager".

KingChris · Answer

If you have not reported a bug or a feature, then there will be no way for this to be included. 
 You obviously have some issues with the timeout values of the UDP settings. However my previous comment of using the backup option within the multi WAN gateway still applies. 
 When the backup gateway fails back when the primary/active gateway comes alive, ALL sessions are killed and served through the new gateway. 
 If your VOIP provider is still trying to reach the old IP address and its not reachable, and is refusing authentication requests from the new gateway IP, then that is something the VOIP provider will need to address. 
 Alternatively, if you still think the issue lies with the XG, please open a support request so that this can be investigated. If this does turn out to be a feature request, I would suggest you log it on https://ideas.sophos.com . 
 Thanks.