> NAT-keepalives are necessary to ensure that a site > on the "outside" of the NAT can initiate an SA back > to the system stuck behind the NAT. Only UDP NAT mappings require keepalives. TCP NAT mappings don't. -dave