Add a NAT-T keepalive timer in case we are behind a NAT gateway.

Add a NAT-T keepalive timer in case we are behind a NAT gateway.

See RFC 5996, section 2.23, NAT Traversal:
  In the case of a mismatching NAT_DETECTION_DESTINATION_IP hash, it
  means that the system receiving the NAT_DETECTION_DESTINATION_IP
  payload is behind a NAT and that system SHOULD start sending
  keepalive packets as defined in [UDPENCAPS].

With markus@, ok reyk@