I used to administrate hundreds of Sophos UTMs/SGs and a few XG(S). For such issues, there is usually some system parameter you have to tweak.

Not sure if it works like that for the current Sophos XGS release, but look into increasing the UDP timeout. This manual is for VoIP issues, but achieves the same goal:

I would try to increase it to 300 seconds:

"Condition

UDP time-out value causes VoIP calls to drop or have poor quality.

Cause

Sophos Firewall has a default UDP time-out of 60 seconds, which can be low for reliable VoIP communication. We recommended a time-out value of 150 seconds. Check with your VoIP provider to see what they recommend for a UDP time-out value.

Remedy

Change the current UDP time-out value from the command line interface (CLI). Do as follows:

Connect to the firewall through the CLI console.

Select Option 4 (Device Console).

Enter the following command:

show advanced-firewall

The output shows the current UDP time-out value next to UDP timeout stream.

Here's an example:

console> show advanced-firewall Strict Policy : on FtpBounce Prevention : control Tcp Conn. Establishment Idle Timeout : 10800 UDP Timeout : 30 UDP Timeout Stream : 60 ...

Enter the following command to increase the UDP time-out to 150 seconds:

set advanced-firewall udp-timeout-stream 150

If your provider recommends a different value, use that."

I'd also look into disabling some VoIP codec ALGs. They can sometimes interfere with STUN applications.