Here is a brief description of my issue., as brief as i can make it anyways.
I have a few clients using a cloud based phone system, where the VOIP phones sit on the inside of the network connecting out to a phone system on the outside. At these specific locations, they are setup with multiple internet lines terminated on an ASA 5505 (version 8.2(5)), and are using tracked routes w/ sla monitor for line fail-over.
Here are the pertinent lines of the config:
ip address 10.20.30.1 255.255.255.0
ip address 192.168.100.225 255.255.255.0
no forward interface Vlan2
ip address 184.108.40.206 255.255.255.0
access-list acl_out extended permit icmp any any
access-list acl_backup extended permit icmp any any
global (outside) 1 interface
global (backup) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
access-group acl_out in interface outside
access-group acl_backup in interface backup
route outside 0.0.0.0 0.0.0.0 192.168.100.1 1 track 1
route backup 0.0.0.0 0.0.0.0 220.127.116.11 254
sla monitor 1
type echo protocol ipIcmpEcho 18.104.22.168 interface outside
sla monitor schedule 1 life forever start-time now
track 1 rtr 1 reachability
My problem occurs during a failure scenario... when the primary line goes down, the route fails over and after a short period, 30-45 seconds or so the phones are back in order, dialing and receiving no issues, 2 way audio working etc.. so no problems here.
The issue happens when i fail back to the primary line. In this case, the route switches back to the primary line and the phones re-establish themselves, but now are stuck with only 1 way audio for both inbound and outbound calls.
After setting this up in a lab to play, I realize why. The ASA, after failing back to the primary line is still holding onto and xlate / connection over the backup interface for SIP (tcp 5060 to the phone)
ciscoasa# show conn | include 10.20.30.10
TCP backup 22.214.171.124:5060 inside 10.20.30.10:51358, idle 0:00:41, bytes 50525, flags UIO
I found out the VOIP vednor is hitting the phone every 45 seconds or so with a SIP, i guess you could say keep-alive and given when i fail back to my primary line the backup line never really goes "down", they continue to send their 45 second interval sip packet to the backup IP, the xlate never clears and and this connection never clears, thus causing my 1 way audio issue.
A reboot of the phone, or a clear xlate on the firewall does the trick, the phone re-establishes itself over the primary line, the stale connection get's dropped and all is good.
My question here: Does anyone know of a way to force a clear xlate on the ASA, when the tracked route changes. I have tossed around the idea of using SNMP traps to a syslog server to watch for the event, and in turn send an SNMP write back to the ASA with the "clear xlate" command, but am looking to find a way to not rely on anything outside the ASA to handle the routing for this.
Any ideas or thought appreciated!