[the8472]

tcp keepalive interval defaults to 2 hours on most systems, that's not sufficient to keep NAT mappings open. So besides enabling keepalive you also need to adjust the interval.