We have a Kamailio server as an edge proxy and mid-registrar behind NAT on the same LAN as the PBX. The phones are remote (behind NAT as well).
When the phone sends a NOTIFY with Event: keep-alive Asterisk responds with a 501 Not Implemented.
That depends on what exactly is required. Asterisk is still responding to the NOTIFY, so it depends if the remote side cares about the response or not. Otherwise OPTIONS will respond with a response, depending on circumstances. (Authentication required, etc)